hey
I'm presently getting inundated with incoming NetBIOS probles from all over the place.....ois there someting going on (as in a worm)?
hey
I'm presently getting inundated with incoming NetBIOS probles from all over the place.....ois there someting going on (as in a worm)?
It could be W32.Bird.A@MM. It is new and it will try and spread via network shares.
Cheers:
I just checked my IDS logs and I am not seeing anything unusual yet....
When BugBear first was exposed, my firewall at my house was getting slammed with 137's as well - I did some checking, and I concluded that the probes were more than likely BugBear infected machines...
Agree with Maverick. A good place to look if you are getting inundated with traffic is :
www.incidents.org
They have a distrubted IDS type system setup where people supply firewalls and ids logs to report who is scanning/doing bad things. You can at least see if other people are seeing the type of traffic you are seeing, and what, if they know, is causing it...
You should see one of the first titles there is increased 137 scans...probably your culprit.
/nebulus
Hi all;
There is this real neat program that will do just what you are seening...
It will run on all of the M$ os's
http://www.rawlogic.com/
It is a real good way to test your own shares
as well....
I guess Neat is a little heavy for a tool that will scan
both class "c"s and "b"s with no extra input
and can be used to break into a computer.....
Sorry...long day...been working outside installing some customer equipment
ever since i got ADSL and set up a small four-computer home lan, my router has been catching scans from computers...destined for ports 137-139. At first I reported them to my ISP...but I never got a response so I assumed they did nothing so I just ignore it now.
As long as your firewall is catching...and stopping (duhh) it, then I wouldn't worry about it, but that's just me.
I'm been getting the same but on 137 but via UDP, at the rate of one a minuate, and like you said they are from all over the place
Are you sure they're not replies to packets your Windoze machine sends out?
Does your windoze box send DNS requests originating from 137?
Or is your box sending its own NETBIOS-NS requests and recieving responses from them?
Do you have the contents of a few packets you could share with us?
Personally, my firewall is set up to block certain ports, and 137 - 139 is one of them, I usually block TCP and UDP if posible. You might wanna do same, that way you wont have to worry about it. If my memory serves me right 139 is like a finger...info look up. All you IRC people might know what finger cmd is. :cool: :rolleyes:
The slamming continues.....here's my incoming log:Quote:
Originally posted here by slarty
Are you sure they're not replies to packets your Windoze machine sends out?
Does your windoze box send DNS requests originating from 137?
Or is your box sending its own NETBIOS-NS requests and recieving responses from them?
Do you have the contents of a few packets you could share with us?
64.246.79.243 137
218.64.91.173 137
130.37.56.127 137
209.202.101.214 137
210.230.112.187 137
63.136.112.231 137
218.77.226.141 137
61.0.208.5 137
210.94.46.141 137
203.229.163.4 137
200.168.132.44 137
200.170.244.101 137
80.105.217.198 137
200.82.170.213 137
216.147.137.64 137
211.191.41.226 137
200.35.100.80 137
62.175.156.207 137
151.24.217.33 137
64.170.52.138 137
80.6.125.129 137
206.28.189.39 137
200.204.179.6 137
200.228.81.73 137
206.49.32.178 137
64.173.8.229 137
62.11.19.181 137
193.194.184.71 137
218.232.248.51 137
212.145.131.33 137
148.244.164.31 137
61.130.126.76 137
212.175.169.249 137
212.253.186.194 137
151.24.19.153 137
81.112.48.123 137
61.75.47.2 137
213.176.191.138 137
200.72.214.10 137
200.151.152.200 137
210.91.161.87 137
62.83.123.215 137
193.133.125.109 137
64.32.122.138 137
61.60.158.229 137
217.53.4.187 137
61.11.52.74 137
193.225.172.158 137
218.144.133.34 137
61.77.191.45 137
213.81.218.11 137
61.140.50.8 137
211.221.88.95 137
61.82.102.72 137
195.132.22.75 137
61.229.90.231 137
200.253.200.27 137
203.232.233.88 137
211.91.111.84 137
219.93.229.118 137
200.167.225.51 137
200.253.188.66 137
80.25.28.206 137
213.46.28.70 137
194.90.152.84 137
217.58.55.145 137
218.86.175.137 137
62.174.164.167 137
63.84.237.174 137
213.22.235.160 137
There are no requests for port 137 going out either.....must be a worm out there
Quote:
Originally posted here by Deranger187
Personally, my firewall is set up to block certain ports, and 137 - 139 is one of them, I usually block TCP and UDP if posible. You might wanna do same, that way you wont have to worry about it. If my memory serves me right 139 is like a finger...info look up. All you IRC people might know what finger cmd is. :cool: :rolleyes:
Actually, just to clarify, ports 137-139 are used for NetBIOS, not Finger....
Ratman...look at the web site I mentioned...You will see that over 50% of the scans in North America are currently on port 137...and they have largely been attributed to bugbear. Would be a very good thing to block udp 137, udp 138, tcp 139 (netbios), and udp/tcp 445 (win2k netbios) at your router/firewall. Those protocols are so inherently insecure that you shouldn't be allowing the outside world to connect in to them...
/nebulus
Thanks for all the suggestions here, I looked at my logs as soon as I read Ratman's post and found that I am being bombarded on port 137 too. I noticed it yesterday but didn't have time to do anything with it. :D
Also people probe those ports. If open they can gather your account name's/ simple passwords and shares on your pc remotely. There is many tools that do it. You can use a program via DOS called NBTdump to check if your system spits out any information.
Usually if your running a firewall nothing will be sent by (based on my experience, have you.)
This is a stupid question but I was reading where some of the members are having 137 port attacks/scans... So I checked my firewall (Zone Alarm).... In a matter of about 3 hours I have had 4000 attempted attacks.... I am trying to understand ports and what all the acronyms mean that go along with computer speech.... What does Source DNS mean? And how do I block mt NetBios ports and anyother port for that matter... I have checked around and even asked some people who "say" they know about computers but so far no luck..... :confused:
Thanks,
:)
Dreamer:
Source DNS in ZoneAlarm is just the name of the computer which attempted to connect to your computer on that port (can be resolved to and from IP addresses). To block your netbios ports and any other ports, get a firewall like Tiny or Kerio. All you have to do then is create a rule that doesn't let any connections in on ports 137-139 for netbios blocking. And you can block any other ports you like as well. The best thing about these firewalls is you have far more control over what goes on. ZoneAlarm is probably blocking your netbios ports anyway, but Tiny/Kerio are great for learning more about ports etc.
good luck :)