On Thursday 11 November 2004 17:59, Eric Scott wrote: > Yo; > Once again, another question to be applied on my Mandrake 9.2 server > box, > which you're probably starting to become friends with. I leave KDE System > Guard open at times on my SuSE box monitoring the Mandrake server remotely. > I've noticed that a TCP connection opens occasionally, connected to from > hosts all around the world (China, UK, u-name-it) to a "netbios-ssn" > socket. What's happening here? What's netbios-ssn? All I'm running is a > website for a local buisness at the moment... I can't imagine why peeps > from China and the UK would want to access this server... are these > crackers? Do I have a clue what I'm talking about? > Thanx, > ES
It means that you are running Samba, and are either not running a firewall, or have opened the firewall to Samba (By default it will be closed). netbios-ssn is port 139 It means that people all over the world can see your Samba shares, and if they can guess your password they can look at them too. The good news is that most of these people will be innocent Windows users who have no idea they are scanning the Internet with 'Network Neighborhood'. But some of them may not be very nice... If you go to http://scan.sygatetech.com/ you can check which other ports are open. derek -- www.jennings.homelinux.net http://twiki.mdklinuxfaq.org
____________________________________________________ Want to buy your Pack or Services from MandrakeSoft? Go to http://www.mandrakestore.com Join the Club : http://www.mandrakeclub.com ____________________________________________________
