Members
  • Total Members: 12818
  • Latest: martin
Stats
  • Total Posts: 28534
  • Total Topics: 8240
  • Online Today: 1027
  • Online Ever: 51419
  • (01. January 2010., 10:27:49)












Author Topic: Many Packets to Port 137  (Read 11450 times)

0 Members and 1 Guest are viewing this topic.

haz

  • SCF Advanced Member
  • ***
  • Posts: 117
  • KARMA: 26
  • Gender: Male
Many Packets to Port 137
« on: 20. April 2009., 11:08:30 »
Hello,
I was configuring a new firewall in the company when I accidently noticed in the log file that a certain IP is broadcasting packets to udp port 137 and sometimes 138, when I disconnected that PC I noticed other PCs started to broadcast the same packets ! I dont know what causes them, I disconnected another one and ran a full scan using "Super Anti-Spyware" with latest definitions and no results were found.
The port maps to NetBIOS Name Service, but we dont have such service running in our network!  ??? we do have a DNS server though.
Is this a normal behaviour or not ?
Thanks..

Samker's Computer Forum - SCforum.info

Many Packets to Port 137
« on: 20. April 2009., 11:08:30 »




georgecloner

  • SCF VIP Member
  • *****
  • Posts: 171
  • KARMA: 16
  • Gender: Male
Re: Many Packets to Port 137
« Reply #1 on: 20. April 2009., 11:58:49 »
Hello,
I was configuring a new firewall in the company when I accidently noticed in the log file that a certain IP is broadcasting packets to udp port 137 and sometimes 138, when I disconnected that PC I noticed other PCs started to broadcast the same packets ! I dont know what causes them, I disconnected another one and ran a full scan using "Super Anti-Spyware" with latest definitions and no results were found.
The port maps to NetBIOS Name Service, but we dont have such service running in our network!  ??? we do have a DNS server though.

Is this a normal behaviour or not ?
Thanks..

These ports are basic windows ports:

137    NetBIOS name service. This is how NetBIOS-based services find each other. On a NetBIOS network, these names uniquely identify the machine and services running on the machine (and the IP address doesn't matter). Machines find each other either using broadcasts or looking them up in a centralized NetBIOS naming server (called a WINS server).
138    NetBIOS datagram service. This is primarily used for broadcasting information. It is primarily used by the SMB browser service that fills the information within the "Network Neighborhood" icon.

Hence, UDP ports 137 and 138 are considered normal traffic that every computer is announcing their existence in a network environment because of "WINS/NetBT name resolution."

-when a wintel machine boots up it broadcasts its NetBIOS name on the local subnet to register with the browse master
-A computer with resources broadcasts an announcement every 12 minutes to refresh the browse lists.
-browser traffic is normally done by broadcast, over UDP port 137. (If there is a WINS server on the network, browser traffic will be directed, not broadcast. )

Creativity is a mental and social process involving the generation of new ideas or concepts, or new associations of the creative mind between existing ideas or concepts.

haz

  • SCF Advanced Member
  • ***
  • Posts: 117
  • KARMA: 26
  • Gender: Male
Re: Many Packets to Port 137
« Reply #2 on: 20. April 2009., 12:52:43 »
So it IS a Normal thing ! phew ! I just thought they were too much to be normal traffic, thats why I wanted to make sure.
Thanks a lot georgecloner.

georgecloner

  • SCF VIP Member
  • *****
  • Posts: 171
  • KARMA: 16
  • Gender: Male
Re: Many Packets to Port 137
« Reply #3 on: 20. April 2009., 17:40:30 »
There are trojan/worms where actually uses these ports, but as long as you're updated shielding your PCs there will be no worries!

You should be more concern and alarm if port 139 has been seen for simultaneous access! Someone may successfully connect to your PC and access resources available.
Creativity is a mental and social process involving the generation of new ideas or concepts, or new associations of the creative mind between existing ideas or concepts.

manual2100

  • SCF Member
  • **
  • Posts: 61
  • KARMA: 10
Re: Many Packets to Port 137
« Reply #4 on: 12. October 2010., 12:02:58 »
if you are in a company network this is normal

krrjhn

  • SCF Advanced Member
  • ***
  • Posts: 213
  • KARMA: -5
Re: Many Packets to Port 137
« Reply #5 on: 17. January 2011., 07:43:33 »
Its a normal problem in a company !!

 

With Quick-Reply you can write a post when viewing a topic without loading a new page. You can still use bulletin board code and smileys as you would in a normal post.

Name: Email:
Verification:
Type the letters shown in the picture
Listen to the letters / Request another image
Type the letters shown in the picture:
Second Anti-Bot trap, type or simply copy-paste below (only the red letters):www.scforum.info:

Enter your email address to receive daily email with 'SCforum.info - Samker's Computer Forum' newest content:

Terms of Use | Privacy Policy | Advertising