From owner-freebsd-security Wed Oct 28 17:30:29 1998 Return-Path: Received: (from majordom@localhost) by hub.freebsd.org (8.8.8/8.8.8) id RAA04264 for freebsd-security-outgoing; Wed, 28 Oct 1998 17:30:29 -0800 (PST) (envelope-from owner-freebsd-security@FreeBSD.ORG) Received: from socrates.i-pi.com (socrates.i-pi.com [198.49.217.5]) by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id RAA04230 for ; Wed, 28 Oct 1998 17:30:13 -0800 (PST) (envelope-from ingham@i-pi.com) Received: (from ingham@localhost) by socrates.i-pi.com (8.8.8/8.8.7) id RAA04603; Wed, 28 Oct 1998 17:12:02 -0700 (MST) (envelope-from ingham) Message-ID: <19981028171202.A4585@i-pi.com> Date: Wed, 28 Oct 1998 17:12:02 -0700 From: Kenneth Ingham To: patl@phoenix.volant.org, security@FreeBSD.ORG Subject: Re: Cause of NetBIOS-NS requests from outside References: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Mailer: Mutt 0.93.1i In-Reply-To: ; from patl@phoenix.volant.org on Wed, Oct 28, 1998 at 03:01:35PM -0800 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org On Wed, Oct 28, 1998 at 03:01:35PM -0800, patl@phoenix.volant.org wrote: > I've recently started logging more of the packets which are denied > by my filters. Since then, I've noticed occasional bursts of UDP > packets aimed at the NetBIOS-NS port (137) on my primary server. > > Is this more likely to be M$ brain-damage, or an attempted probe > by some script-kiddie? M$ brain-damage. I worked with one of the people who was bouncing off of my firewall one time. If you are using WINS for anything, it tries to use it for everything. I now ignore them, and really should tell the firewall to not even log them. Kenneth To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message