Re: [cobalt-users] Port 137 Scans

[shimi <shimi@xxxxxxxxxxxxxxxx>]

On Mon, 23 Apr 2001, Wayne Sagar wrote:

> Anybody seen this "guy" trying them on 137?
> 
> Active System Attack Alerts
> =-=-=-=-=-=-=-=-=-=-=-=-=-=
> Apr 23 07:16:24 www portsentry[527]: attackalert: Connect from host:
> ws56171.ocar.army.pentagon.mil/134.11.56.171 to UDP port: 137
> Apr 23 07:16:24 www portsentry[527]: attackalert: Host 134.11.56.171 has
> been blocked via wrappers with string: "ALL: 134.11.56.171"
> 
> Same host has hit me on at least three different ip's... sort of a strange
> host dont'cha'think?

Basically it's a windoze looking around to see network neighbours to it's
"network neighbourhood"...

how he got to your IPs? no idea, perhaps misconfigured...

anyhow, it's the netbios name service, and you shouldn't be worried.

of course, you could have known it yourself:

[shimi@shimi shimi]$ cat /etc/services | grep 137
netbios-ns      137/tcp                         # NETBIOS Name Service
netbios-ns      137/udp    

> 
> Wayne
> 

- shimi.