From owner-freebsd-security  Thu May  1 13:02:13 1997
Return-Path: <owner-security>
Received: (from root@localhost)
          by hub.freebsd.org (8.8.5/8.8.5) id NAA12709
          for security-outgoing; Thu, 1 May 1997 13:02:13 -0700 (PDT)
Received: from rocky.mt.sri.com (rocky.mt.sri.com [206.127.76.100])
          by hub.freebsd.org (8.8.5/8.8.5) with ESMTP id NAA12698
          for <freebsd-security@freebsd.org>; Thu, 1 May 1997 13:02:08 -0700 (PDT)
Received: (from nate@localhost) by rocky.mt.sri.com (8.7.5/8.7.3) id OAA29546; Thu, 1 May 1997 14:01:53 -0600 (MDT)
Date: Thu, 1 May 1997 14:01:53 -0600 (MDT)
Message-Id: <199705012001.OAA29546@rocky.mt.sri.com>
From: Nate Williams <nate@mt.sri.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
To: Chris Cason <maillist@gateway.oaks.com.au>
Cc: freebsd-security@freebsd.org
Subject: Re: MS Exchange mail server and port 137
In-Reply-To: <199705011521.BAA21766@gateway.oaks.com.au>
References: <199705011521.BAA21766@gateway.oaks.com.au>
X-Mailer: VM 6.29 under 19.15 XEmacs Lucid
Sender: owner-security@freebsd.org
X-Loop: FreeBSD.org
Precedence: bulk

> I recently noticed that, a few seconds after I sent an email to a
> a recipient who was using Microsoft Exchange server internet mail
> connector version 4.0.994.63, my IPFW setup logged to the console
> that several probes came to UDP port 137 (Netbios name service.)
> 
> I've only recently firewalled these ports out so this may be a
> common occurrance ... has anyone seen this before, or know why
> they do it ? Is the ME server looking for host information
> automatically ?

I see them all the time when I hit certain WWW sites.  I'm not sure what
is going on, but I've learned to ignore them.


Nate