[PLUG] DShield, anyone using this?

AthlonRob athlonrob at data.4t3.com
Fri Nov 22 01:33:15 UTC 2002


On Thu, 2002-11-21 at 16:53, Michael Luevane wrote:
> Port 137 (and 138, 139) are NetBIOS ports. I *think* that this may be due to
> the Bugbear virus which propogates through NetBIOS over your network. It's
> not you, it's other machines "out there".
> 
> I've got it too. My logs get filled with "port 139" attacks (which is a
> NetBIOS vulnerability attack) and port 137 hits.

I get hit on 137 through 139 regularly - Windoze boxen on my subnet
constantly broadcast to and from them looking for other Windoze boxen
they think are on their local network.

If I don't filter them out of my logs, I record about three hits per
minute on each of those ports.

-- 
AthlonRob <athlonrob at data.4t3.com>





More information about the PLUG mailing list