UDP Port 137
Netbios Name Service is typically how Windows computers find out information
concerning the networking features offered by a computer, such as System Name,
File Shares, etc.
Inbound scans can be the result of everything from a harmless Reverse DNS
lookup to a malicious scan for the availability of open shares to exploit.
Currently most inbound scans are the result of a number of worms such as BugBear
and Opaserv which exploit open file shares to propagate.
Outbound scans if occurring in volume should be considered an indication of a
possible worm infection on the source computer and should be investigated.
Day and a Night with PortPeeker and UDP port 137
137 Scans or 'Intro to Basic Forensics'
Link Logger inbound scans/attack report for
selected ports from one of our test systems. NOTE the reported system would be typical for high speed home users.
Link Logger unique source IP addresses per
hour for selected ports from one of our test systems. NOTE the reported system would be typical for high speed home users.
Page last updated on
February 16, 2004