169.254/16 is the auto-configure network; characteristically seen from a Win98 system
during boot. Make certain your hosts all have assigned IP addresses or else run a DHCP
server.
61000 corresponds to a MASQ-ed connection and 137-139 correspond to NetBIOS requests.
A freshly-booted Win98 system was probably trying to find out who it's (169.254/16)
neighbors are.
As another has indicated, you should block both incoming and outgoing ports 137-139.
Scott Holmes (scotth at geosoft dot cc) asked:
>I spotted some denied outbound attempts from my firewall's external IP
>to a 169.254.X.X address. The source port was 61000 and the destination
>was 137. 61000 is IP Masqurading and 137 is NetBios right? I was not
>trying to access a netbios share over the net, what's going on?
-
[To unsubscribe, send mail to [EMAIL PROTECTED] with
"unsubscribe firewalls" in the body of the message.]
