disturbing netstat find
Results 1 to 3 of 3

Thread: disturbing netstat find

  1. #1
    Senior Member
    Join Date
    Jul 2002
    Posts
    123

    disturbing netstat find

    hey all, quick question, i was messing around with netstat and nmap just seeing what i could find on my college network, well i did a "netstat -a" command and noticed this

    tcp mycomp:3864 lacompto.mycollege.edu:netbios-ssn time_wait
    tcp mycomp:3868 lacompto.mycollege.edu:netbios-ssn established

    (i changed the DNS for obvious reasons)
    is someone connected to my computer using netbios? or is this just the result of someone attempting to scan for ports on my computer when i asked for a netstat report.

    i thought you could only connect to netbios on port 139.

    i have a firewall running and i have disabled file/print sharing and im fairly sure i have disable the netbios service...how is this possible? any/all advice is appreciated.
    speak your mind becuase those who matter don\'t mind and those who mind don\'t matter

  2. #2
    Member
    Join Date
    Dec 2003
    Posts
    43
    Well, considering that the netbios port is listed on the remote machine, and your laptops port are above 1024, I would guess that those connections originate from your laptop, going to the other machine, rather than the other way around.

    EDIT

    If there was an inbound netbios connection from the other machine to yours, it would show the netbios connection on your machine and the unreserved ports on the other end.

    Do you use a domain name when loggin into your machine? like you log in as yourself into the mycollege.edu domain?

    It could just be your machine connecting to the local master browser in order to populate the hosts which would get listed in network neighborhood/my network places.

    I don't know off the top of my head what that connection would be exactly, but it does origniate at your machine.

  3. #3
    Senior Member
    Join Date
    Jul 2002
    Posts
    123
    haha, im dumb i forgot netstat also shows outbound connections, thanks for the info tabich
    speak your mind becuase those who matter don\'t mind and those who mind don\'t matter

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

 Security News

     Patches

       Security Trends

         How-To

           Buying Guides