Printable View
Hey all, My firewall (Zone Alarm) Blocked a connection attempt on port 137(NetBIOS if I remeber correctly) . Normally, I wouldn't have batted an eye, but the odd thing is that the computers on my local network were all off and it came from an external IP (The Internet). Is this a worm, or what ? I am not serving anything off any of my home computers so I don't know why an external IP would be trying to connect on my NetBIOS port.
Well what is more weird is if you are behind a router. Traffic should not be let through to your computer on port 139 if it is setup right.
But I wouldnt worry too much about it.
Not to clear about your system, but if you are connected to the internet then you will get these probes.............they are bots/infected machines running automatic scans of IP address ranges mostly.
Over here I get quite a lot of them, they used to mostly come from machines on my ISP sub-net. It could also be some skiddie messing around, but the chances of finding you would be pretty remote I would have thought.
At the end of the day it is not the ones your firewall blocks that matter................it is the ones it doesn't :eek:
Hi
It has been asked - somehow :) : What is your LAN setup? It looks like you have one
machine acting as "gateway" for the other boxes.
Then, it is explainable that you receive 137 attempts from outside on that machine.
I also bet, the source was one machine within the subnet of your ISP you are in.
Otherwise: Configure your router properly, which means in short:
Disallow any incoming traffic except for servers possibly running within your network.
What is a request on [UDP] 137? (as mentioned in your post, disregarding the title)
This might be a WINS broadcast request, with high probability. WINS is an older way for
NetBIOS name resolution and is sent by default from a lot of Windows machines.
Often, it is nothing to worry about (but I have already proven in earlier posts that I am not
paranoid enough :) )
If it is incoming traffic on Port 139, then it might be some attempt, as mentioned by
nihil. First, make sure that such packages are dropped at your firewall, second, and
in any case, patch your machines.
Cheers
Are you sure it isn't just an attempted pop up spam? I read somewhere that sometimes they connect on alternate ports etc.Quote:
Originally posted here by dmorgan
Hey all, My firewall (Zone Alarm) Blocked a connection attempt on port 137(NetBIOS if I remeber correctly) . Normally, I wouldn't have batted an eye, but the odd thing is that the computers on my local network were all off and it came from an external IP (The Internet). Is this a worm, or what ? I am not serving anything off any of my home computers so I don't know why an external IP would be trying to connect on my NetBIOS port.
The thing is, on my network, I got this; DSL Modem --> little linksys switch --> 2 computers (1 Linux) (1 win XP). Now all my network traffic is DHCP, starting at 192.168.0.2 (192.168.0.1 is my DSL Modem). This incoming (UDP) on port 137 was from 66.***.***.*** or 88.***.***.*** It was 137, I was mistaken in saying 139. Anyways thanks guys.
Are you sure that 'little linksys switch' is *just* a switch? Depending on the DSL modem you have, you could be wide-open to internet traffic (except as filtered by your ISP). I don't know a LOT about DSL, having used it briefly, but I know most of the cable modems Ive used don't really filter anything.
You might consider putting a second NIC in the Linux box and running IPTables, dhcpd, etc. ...using it as a router/firewall. There are some good howto's on this...I did it for years before buying a Router/Switch/Firewall appliance thing-a-ma-jig.
Hi nihil,Quote:
Originally posted here by nihil
Not to clear about your system, but if you are connected to the internet then you will get these probes.............they are bots/infected machines running automatic scans of IP address ranges mostly.
Over here I get quite a lot of them, they used to mostly come from machines on my ISP sub-net. It could also be some skiddie messing around, but the chances of finding you would be pretty remote I would have thought.
At the end of the day it is not the ones your firewall blocks that matter................it is the ones it doesn't :eek:
I guess i have a question for you...
Some days back i was looking at my firewall daily logs and i noticed a weird thing a web site(don't want to give out name it was a pakistani web site) trying to connect on a perticular port on my machine(sorry i don't remember port number).
Then some days later anather weird incident a perticular Ip address tried to connect to a perticular port on my system.
That Ip Address was from somewhere in amsterdam.
Now the most important part of this is that my system is connected to internet through a proxy server(Which basically means that it is a illegal connection).
i am not sure what they were trying to do specially that web site.
Any idea???
(Which basically means that it is a illegal connection)......why would connecting through a proxy be illegal?
Greeting's
I agree with nihil, they are nothing but probes but anyway if you want to be extra secure you can right click on these ip's (in the logs section of zonealarm firewall) and add them to "untrusted zone" this will help because zonealarm will not let your compuer communicate with that IP address.
Reply to littlenick's post :
If you can you should give us atleast detail of port at which these websites were trying to connect too, it might help us get a more precise reply also including you oprating system and the firewall you use should help.
It would be illegal if it is a non tax paid connection And basically the whole LAN of my cable service provider is illegal.Quote:
Originally posted here by JAZZMAN
(Which basically means that it is a illegal connection)......why would connecting through a proxy be illegal?
Well i don't really remember Port numbers(sorry for that).Quote:
Originally posted here by ByTeWrangler
Greeting's
I agree with nihil, they are nothing but probes but anyway if you want to be extra secure you can right click on these ip's (in the logs section of zonealarm firewall) and add them to "untrusted zone" this will help because zonealarm will not let your compuer communicate with that IP address.
Reply to littlenick's post :
If you can you should give us atleast detail of port at which these websites were trying to connect too, it might help us get a more precise reply also including you oprating system and the firewall you use should help.
What is important to me is why would any web site try to connect to a port number on my PC when that port is not open(infact that site tried to connect to 2 ports both were closed).
How can a web site that i never visited get my IP address(specially when my LAN is behind a proxy server).
Hi littlenick,
If you PM me with the website details I will try to take a (VERY DISCRETE) look. I have the advantage of a number of labrats (test boxes) that I do not care what happens to, as I just blitz a mirror back onto them............you need to do that each time you start a new project, ( to get a level playing field or "sterile environment") so it is no big deal.
OK.....on to your question: as you are behind a proxy, you should not be sending out your IP address beyond the proxy. So, it seems logical to me that either your IP address was known BEFORE you started using the proxy, or something on your machine is "phoning home".
There is a vague possibility that a random scan found the proxy and asked for your IP address.........in which case the proxy would forward the packets...........it shouldn't!
Do you have a fixed IP address and a fixed proxy? if so, then it would be slightly more understandable?
I would do a full anti-spyware/adware scan (SAFE MODE please :) ) an online AV scan (PC-Cillin/Panda) and get the free version of ZoneAlarm, and set it to maximum security. I am not saying that ZA is the best firewall by any means, but it is a quick check for stuff trying to connect outwards from your computer. Check your BHOs clear your cookies and cache (don't forget the Java cache:)) history, temporary files etc. PATCH your OS!!!!!!...........you know the drill?
This is a VERY simplistic way of looking at it:
say I am 456.456.456.456 and my proxy is 123.123.123.123.
I send a message to 666.666.666.666, who thinks that it is 123.123.123.123 talking, and responds accordingly. 123.123.123.123 passes the message on, and it is received by 456.456.456.456.
In theory, the proxy should not respond to a message it did not initiate so if 666.666.666.666 sends a packet "out of the blue" and says deliver that to 456.456.456.456, it should not respond if it is acting as a true proxy. This might indicate that the proxy is compromised/not working properly or you have "something nasty in the woodpile"
Good luck
:)
Well nihil as i said before it is a illegal internet connection has no record and to my understanding has no global ip address(i believe).Quote:
Originally posted here by nihil
If you PM me with the website details I will try to take a (VERY DISCRETE) look. I have the advantage of a number of labrats (test boxes) that I do not care what happens to, as I just blitz a mirror back onto them............you need to do that each time you start a new project, ( to get a level playing field or "sterile environment") so it is no big deal.
OK.....on to your question: as you are behind a proxy, you should not be sending out your IP address beyond the proxy. So, it seems logical to me that either your IP address was known BEFORE you started using the proxy, or something on your machine is "phoning home".
There is a vague possibility that a random scan found the proxy and asked for your IP address.........in which case the proxy would forward the packets...........it shouldn't!
Do you have a fixed IP address and a fixed proxy? if so, then it would be slightly more understandable?
My PC is a part of a LAN and i am not sure how a web site can find out my ip address
There is some additional information in PM.
Thanks
Most likely this is just a port scan by a script kiddie who is trying to gather information about your Microsoft machines. If you are not being scanned then you are not connected to the internet! Ports 136 - 139 TCP or UDP are strictly for the good old boys at Microsoft which were used to provide info for a domain controller regarding your windows machines on a windows domain. Obviously this was not a good idea because someone with too much time on their hands has created tools which mine data on those ports for later use. Here is a short list of those ports from the fine folks at IANA. Credit this website with the listing:
http://www.iana.org/assignments/port-numbers
profile 136/tcp PROFILE Naming System
profile 136/udp PROFILE Naming System
netbios-ns 137/tcp NETBIOS Name Service
netbios-ns 137/udp NETBIOS Name Service
netbios-dgm 138/tcp NETBIOS Datagram Service
netbios-dgm 138/udp NETBIOS Datagram Service
netbios-ssn 139/tcp NETBIOS Session Service
netbios-ssn 139/udp NETBIOS Session Service
I also recommend self scanning to learn a little bit more about what your system is doing. For your microsoft machines use the netstat command. A pretty good tutorial about that is located here:
http://www.microsoft.com/resources/d...s/netstat.mspx
This will identify those connections that are just waiting for a script to be thrown there way. I hope that helps....
I had the same problem awhile back, in fact it was one the first questions I asked when I joined this site...I was regularly being informed ( about 33 times a day ) by Zone Alarm that NetBios was trying to connect to port 139..and I am on a home comp not on a network....
then all of a sudden it stopped...and I'm not sure why but it coincidentily stopped about the same time I stopped going to another computer forum I was attending ( that often joked about the fun they had hacking and playing their little practical jokes...I don't think there was any regular member or staff over the age of 22...they had mods as young as 14 ) where I had words with one of their members who is an IT administrator ( age 19 ), and I haven't had the problem since.
Cool, after reading up a little on Zone Alarm (not to mention it was giving me the BSOD about 20 seconds after I logged on) I switched to Sysgate. Hopefully I'll be a little more protected...
.... Now about the illegit versions of windows and not being able to get a patch... :D Oh well. I've been meaning to buy it anyway, now I have to...