Hello,
I was configuring a new firewall in the company when I accidently noticed in the log file that a certain IP is broadcasting packets to udp port 137 and sometimes 138, when I disconnected that PC I noticed other PCs started to broadcast the same packets ! I dont know what causes them, I disconnected another one and ran a full scan using "Super Anti-Spyware" with latest definitions and no results were found.
The port maps to NetBIOS Name Service, but we dont have such service running in our network! we do have a DNS server though.
Is this a normal behaviour or not ?
Thanks..
These ports are basic windows ports:
137 NetBIOS name service. This is how NetBIOS-based services find each other. On a NetBIOS network, these names uniquely identify the machine and services running on the machine (and the IP address doesn't matter). Machines find each other either using broadcasts or looking them up in a centralized NetBIOS naming server (called a WINS server).
138 NetBIOS datagram service. This is primarily used for broadcasting information. It is primarily used by the SMB browser service that fills the information within the "Network Neighborhood" icon.
Hence, UDP ports 137 and 138 are considered normal traffic that every computer is announcing their existence in a network environment because of "WINS/NetBT name resolution."
-when a wintel machine boots up it broadcasts its NetBIOS name on the local subnet to register with the browse master
-A computer with resources broadcasts an announcement every 12 minutes to refresh the browse lists.
-browser traffic is normally done by broadcast, over UDP port 137. (If there is a WINS server on the network, browser traffic will be directed, not broadcast. )