From owner-freebsd-security Mon Nov 8 16:27:26 1999 Delivered-To: freebsd-security@freebsd.org Received: from ruff.cs.jmu.edu (ruff.cs.jmu.edu [134.126.20.220]) by hub.freebsd.org (Postfix) with SMTP id 61B1814BFC for ; Mon, 8 Nov 1999 16:27:14 -0800 (PST) (envelope-from cazz@ruff.cs.jmu.edu) Received: (qmail 1307 invoked by uid 522); 9 Nov 1999 00:27:02 -0000 Date: Mon, 8 Nov 1999 19:27:02 -0500 From: Brian To: Lawrence Sica Cc: security@FreeBSD.ORG Subject: Re: Port 137 hitting my server Message-ID: <19991108192702.A494@ruff.cs.jmu.edu> References: <4.2.2.19991108155541.00bcba40@mail.interactivate.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Mailer: Mutt 0.95.4us In-Reply-To: <4.2.2.19991108155541.00bcba40@mail.interactivate.com>; from Lawrence Sica on Mon, Nov 08, 1999 at 03:57:01PM -0800 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org > I keep getting hits to port 137 on my server. I know this is a > netbios thing, and am not running samba. The server in question > is a webserver. I was wondering any legitimate cause for this? sounds like someone has setup one of the zillion 'who is running a samba server on our network' cgi things. they are almost all icky. at jmu, i get around 15 probes a minute from these things. i don't want to count how many times a milisecond i get probed by the 7500 machines on the single subnet i am attached to. (yes, 7500 machines on one subnet, almost all of them using M$ networking, and very few of them actually using the wins server.) -b To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message