From owner-freebsd-security  Thu May  1 08:21:40 1997
Return-Path: <owner-security>
Received: (from root@localhost)
          by hub.freebsd.org (8.8.5/8.8.5) id IAA29133
          for security-outgoing; Thu, 1 May 1997 08:21:40 -0700 (PDT)
Received: from gateway.oaks.com.au (gateway.oaks.com.au [203.29.75.1])
          by hub.freebsd.org (8.8.5/8.8.5) with ESMTP id IAA29125
          for <freebsd-security@freebsd.org>; Thu, 1 May 1997 08:21:36 -0700 (PDT)
Received: (from maillist@localhost) by gateway.oaks.com.au (8.7.6/8.6.12) id BAA21766 for freebsd-security@freebsd.org; Fri, 2 May 1997 01:21:23 +1000 (EST)
From: Chris Cason <maillist@gateway.oaks.com.au>
Message-Id: <199705011521.BAA21766@gateway.oaks.com.au>
Subject: MS Exchange mail server and port 137
To: freebsd-security@freebsd.org
Date: Fri, 2 May 1997 01:21:22 +1000 (EST)
X-Mailer: ELM [version 2.4 PL24]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: owner-security@freebsd.org
X-Loop: FreeBSD.org
Precedence: bulk

I recently noticed that, a few seconds after I sent an email to a
a recipient who was using Microsoft Exchange server internet mail
connector version 4.0.994.63, my IPFW setup logged to the console
that several probes came to UDP port 137 (Netbios name service.)

I've only recently firewalled these ports out so this may be a
common occurrance ... has anyone seen this before, or know why
they do it ? Is the ME server looking for host information
automatically ?

-- Chris