From owner-freebsd-security Thu Aug 20 09:37:49 1998 Return-Path: Received: (from majordom@localhost) by hub.freebsd.org (8.8.8/8.8.8) id JAA08657 for freebsd-security-outgoing; Thu, 20 Aug 1998 09:37:49 -0700 (PDT) (envelope-from owner-freebsd-security@FreeBSD.ORG) Received: from ifi.uio.no (ifi.uio.no [129.240.64.2]) by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id JAA08649 for ; Thu, 20 Aug 1998 09:37:39 -0700 (PDT) (envelope-from dag-erli@ifi.uio.no) Received: from skejdbrimir.ifi.uio.no (skejdbrimir.ifi.uio.no [129.240.65.2]) by ifi.uio.no (8.8.8/8.8.7/ifi0.2) with SMTP id SAA19623; Thu, 20 Aug 1998 18:36:56 +0200 (MET DST) Received: from localhost (dag-erli@localhost) by skejdbrimir.ifi.uio.no ; Thu, 20 Aug 1998 16:36:55 GMT Mime-Version: 1.0 To: Kenneth Ingham Cc: freebsd-security@FreeBSD.ORG Subject: Re: Port 137 (was: Re: private network on router's external NIC?) References: <35D8A7E8.2DC50695@partitur.se> <19980818105321.58178@i-pi.com> Organization: University of Oslo, Department of Informatics X-url: http://www.stud.ifi.uio.no/~dag-erli/ X-other-addresses: 'finger dag-erli@ifi.uio.no' for a list X-disclaimer-1: The views expressed in this article are mine alone, and do X-disclaimer-2: not necessarily coincide with those of any organisation or X-disclaimer-3: company with which I am or have been affiliated. X-Stop-Spam: http://www.cauce.org/ From: dag-erli@ifi.uio.no (Dag-Erling Coidan =?iso-8859-1?Q?Sm=F8rgrav?= ) Date: 20 Aug 1998 16:36:50 +0000 In-Reply-To: Kenneth Ingham's message of "Tue, 18 Aug 1998 10:53:21 -0600" Message-ID: Lines: 14 X-Mailer: Gnus v5.5/Emacs 19.34 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by hub.freebsd.org id JAA08652 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org Kenneth Ingham writes: > On Tue, Aug 18, 1998 at 10:00:54AM +0200, Dag-Erling Coidan Smørgrav wrote: > > Forged packets to the NetBIOS ports are with 99% certainty attempted > > DoS attacks (which will only succeed against Winblows boxen) > Except that Newbios-NS (137) port lookups come from machines with > WINS turned on doing web browsing. [...] > So, port 137 may not be a denial of service attack, could be just > mis-configured boxes. I said *forged*, didn't I? DES -- Dag-Erling Smørgrav - dag-erli@ifi.uio.no To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message