netstat:none , LPS:137.138 open

[coolcamel]

hi

When i use local port scaner(got from www.jpsoft.dk) it shows 137,138 are open ports .but when i use netstat i did not show them as open.

My qustions are :

It seems Dos attack, how can i avoding that and how do i close these ports?
How much good depending on netstat to check open ports?

Thanks n advance

[shadow_dancer]

to close yoru ports do put Firewall .. u may try Sygate, it works well ( my opinion ) .
and about Port 137 and 138 it is just a subscriber to the service, same as you. She/he has probably been infected with some kind of virus, and the best thing you can do is just ignore it.

[ccKid]

CoolCamel,

If I remember correctly ports 137 & 138 are associated with several well known viri/worms and you should make sure that they are closed if not necessary. If you do happen to need them open then you should make sure to have a good firewall and AV application.


ccKid

[snoweagle]

sorry? my answer is not suit of topic.

[Shrekkie]

# Larry Peterson <llp@ARIZONA.EDU>
netbios-ns 137/tcp NETBIOS Name Service
netbios-ns 137/udp NETBIOS Name Service
netbios-dgm 138/tcp NETBIOS Datagram Service
netbios-dgm 138/udp NETBIOS Datagram Service
netbios-ssn 139/tcp NETBIOS Session Service
netbios-ssn 139/udp NETBIOS Session Service
# Jon Postel <postel@isi.edu>

taken from here

So go to your properties of your lan-connection - select TCP-IP - Properties - Advanced - WINS Tab - Select Disable Netbios.

Now your netbios config is out. Unless you're behind a NAT-router and/or a good firewall ( which obviously isn't by seeing your ports open ) I suggest you disable this.

Hope this helps,

***edit***

Btw netstat -help gives you a summary of all options. For.ex. netstat -a gives you all listening ports and connections. Normally you should see this when netbios is on.

UDP SHREKKIE:netbios-ns *:*
UDP SHREKKIE:netbios-dgm *:*

[snoweagle]

Why we'll tomask Nebbos? If i do it like you said ,net speed whether wioo solowly? expectly in a lan.

[coolcamel]

thanks 4 ur time

shadow_dancer

to close yoru ports do put Firewall .. u may try Sygate, it works well ( my opinion ) .and about Port 137 and 138 it is just a subscriber to the service, same as you. She/he has probably been infected with some kind of virus, and the best thing you can do is just ignore it.

am using sygate.what virus using port 137,138( i hope u give me some names)?
----------------------------------------------------------------
ccKid

If I remember correctly ports 137 & 138 are associated with several well known viri/worms and you should make sure that they are closed if not necessary. If you do happen to need them open then you should make sure to have a good firewall and AV application

well ,now its not necessary and we dont use network printer. but in the future may we need these ports and 139.NOW ist safe using that ports bhiend a firewall in case ther is a worm or virus using that ports?
-------------------------------------------------------------------------------------------------------------
.: Shrekkie :.

So go to your properties of your lan-connection - select TCP-IP - Properties - Advanced - WINS Tab - Select Disable Netbios.
Now your netbios config is out. Unless you're behind a NAT-router and/or a good firewall ( which obviously isn't by seeing your ports open ) I suggest you disable this

1st, i remove the netbios from my pcsys:WINME.
2nd,yes am bhind a firwall(sygate),
3rd,yes bhinde NAT-router.

which obviously isn't by seeing your ports open

the firewall shows that port is closed , and i removed the bois .
but when i allow all trafic it seems open and i recived some packets toward that ports- is that normal?
---------------------------------------------------------------
coolcamel

[RoadClosed]

What OS are you running, windows millenium?

[coolcamel]

RoadClosed
yah, my personal computer systm is *winme*(windows millenium).

thnx

[RoadClosed]

when i allow all trafic it seems open and i recived some packets toward that ports- is that normal

If you allow all traffic, chances are you'll see some netbios packetes on that port since any windows machine with netbios enabled will send requests on the local segment. I mean if you open the ports you are going to see stuff from the local network and the internet, so what you see is normal.

You should also seriously consider upgrading to 2k or XP. ME is just not the greatest, even Microsoft jokes about it at their seminars.