Re: lots of port 137 in deny log

[William . Stackpole]

Carl,

There are numerous netbios based scanner out there so "malicious intent" it certainly a possibility. But, I had a similar problem on a firewall I was administering.  I traced it back to a company on the same ISP segment I was on that had netbios enabled on their web and proxy servers.  These two servers accounted  for  700-800 port 137 denies every day.  It was interesting to watch because they would first try specific addresses, then broadcast addresses then class B broadcasts.

It's interesting to monitor segments with NT boxes on them.  Even when you set up security controls on the interfaces to block everything but TCP/IP, they still send our mailbox queries and other garbage.  Go figure.

-- Bill Stackpole, CISSP