| Port 137 probes-anyone else? Hi,
I hope this doesn't seem frivolous, but I have noticed an inordinate amount of probes (attacks?) on UDP Port 137, net bios, in my ZAF logs today. Since 7:00 this AM (9-28-02)I have recorded over 80, and they are still coming .
Is anyone else experiencing this kind of activity? My Ports are all 'stealthed' incl. 139 and 137, but I am curious about all this activity?
Anyone?
TIA
Jack
edited port number in title at poster's request
[text was edited by moderator] |
|
 Occasu$
join:2001-07-20
North Vancouver, BC
| Re: Port 37 probes-anyone else? yes i am also, 56 since yesterday. Could be related to this »www.mynetwatchman.com/kb/securit···/137.htm
[text was edited by author 2002-09-28 17:11:26] |
|
 FiOS DanPremium
join:2001-07-06
Redondo Beach, CA | reply to JackCam614
Wish I could offer you some comfort, Jack, but I just checked Log Viewer and there are no attempts to Port 137 today at all. A handful to 139 and 80, and then others scattered about, but none to 137.
--
"...one nation under God, indivisible, with liberty and justice for all." |
|
 stan999Premium,VIP
join:2001-11-19
Fort Worth, TX | reply to JackCam614
said by JackCam614:
Hi,
Port 137, net bios, in my ZAF logs today. Since 7:00 this AM (9-28-02)I have recorded over 80, and they are still coming .
Jack
Does seem kinda high?
»isc.incidents.org/port_details.h···&srcax=2
Stan Gunn
--
Charter Pipeline Solutions Website, Texas Charter Pipeline Texas Support Board |
|
 planet
join:2001-11-05
Oz
kudos:1 | reply to JackCam614
Good evening Jack,
I too have been getting 137's the past 24 hrs. Got about 80 of em. Been getting hit hard this evening also. |
|
 djaThe 'd' is silent ... unlike the member.Premium
join:2002-03-25
Niagara | reply to JackCam614
Re: Port 37 probes-anyone else? I came here with the same concern
and saw this thread.
338 NetBIOS Name requests in 18 hours.
One every three minutes. No repeat IPs.
Mr. Baldwins' explanations do not
seem to apply to this event.
Now I'm curious. |
|
 dahjingDodging Goblins
join:2002-06-17
West Memphis, AR | reply to JackCam614
Chalk me up for 156 (!!!) UDP Port 137 scans in 24 hours.... There must be an easier way, but I actually hand counted them in my firewall log.  What's UP WITH THIS?!
And BTW - Only 2 repeated IP addresses..... Every single one was a different IP address.... This is weird.
--
'Just because you're paranoid, don't mean they're not after you!!....' |
|
|
|
 AlwillLost time is never found again.Premium,MVM
join:2002-09-25
Sydney, OZ | reply to JackCam614
I too have been experiencing a barrage over the last 24 hours, some 280 all aimed at Port 137.
At least I now know I'm not alone. |
|
| reply to JackCam614
Hi all, many portscans from that on my system, first their origins moved with the sun over the timezones from Korea all around the globe till back there and now they really come from everywhere.
But i found something weird:
Wanting to know what it might be (remembering the CodeRed a year ago) i opened in TDS > Network > TCP Port Listen.
Believe it or not, but on my system this immediately stops the knocking! Only a few port 80 scans. Tried it several times closing and opening the port listen again on port 137 and each time a few minutes after closing the knocks started again.
So people with TDS might like to use this tip, other programs with the Port Listen function might give the same peace or grab your eval copy at the DCS site if you don't have it yet www.diamondcs.com.au. I've been puzzling why this works and my only conclusion can be UDP ports have most of time a TCP twin (look in netstat) but i would have loved to see the packets for some analysis.
I'm thinking of something coordinated like Kazaa: didn't they promise us a big p2p event to overtake the whole internet with that and use all our free CPU space for them?
Blocking the 135-139 ports in our firewall does not stop the knocking, but the "Port Listen" trick seems to do so.
Pity ShieldsUp tests not for 137 TCP/UDP; they should now!
Might be something complete different then Kazaa, i just don't know.
It's also nut just homeusers, it's companies, networks, internet cafes, unis, but mainly homeusers it seems.
Let's keep each other informed!
There might also be a connection with the hackers conference, enjoying themselves with a new toy, but if so, there would have been already something known around the internet.
Puzzling a lot! Looking forward to your finds.
BTW: we have a thread at wilderssecurity forum too,
»www.wilderssecurity.com/index.ph···did=3891 jumping to this one here. |
|
 mra
@tx.charter.co | It's a relief to know it's not just me! FWIW, I am getting a fairly large volume of udp port 137 scans from various places, mostly originating from udp port 1025, but a few 1026s and at least one or two from 1027. I have two IPs on my cable service sending me repeats every 15-45 minutes (can't find a pattern). I've notified someone with our service provider *waves to Stan* about the first one, but he has a friend now. The friend isn't quite as active, though.
I'm terribly ignorant of these things, but learning every day. Can anyone tell me if my free version of zone alarm would notify me if my machine started sending out scans from udp 1025? I have it set for high security. |
|
| Re: Port 137 probes-anyone else?Hi All,
As of yesterday afternoon, I thought Occasu and I had been singled out as targets for Port 137 probes. Now I'm wondering how DSL Dan (3rd poster)is flying under the radar? 
Well after all the informative posts and links here today, it would certainly appear that I am not alone.
"And the beat goes on"... another 36 so far this afternoon.Approx. one every 2 minutes.
Curious situation indeed!
Thanks for all for the feedback and input.
Jack
PS; to MRA. I'm not positive, but I believe ZAF blocks all outgoing traffic regardless of port.(Unless permission granted of coarse) Anyone confirm this?
[text was edited by author 2002-09-29 16:49:14] |
|
AlwillLost time is never found again.Premium,MVM
join:2002-09-25
Sydney, OZ | reply to JackCam614
Still coming fast and furious. In the 9 hours since my last post I've received a further 127 probes of Port 137 so whatever is causing this abnornal activity has not gone away. |
|
djaThe 'd' is silent ... unlike the member.Premium
join:2002-03-25
Niagara | reply to JackCam614
For me it's actually increased.
The rate is now (1) request
every 105 seconds.
As before all IPs are unique. |
|
| reply to JackCam614
I've seen only a single probe in the last 24 hours, and that on my port 139.
--
Mors Principium Est. |
|
 MikeCPremium
join:2001-09-24
Des Plaines, IL | reply to JackCam614
I get about 15-20 a day.
--
MikeC |
|
| reply to JackCam614
This is really interesting. I haven't had ANY myself (seems to be all or nothing for folks in here). But the ICS is reporting a huge spike in hits for port 137. This was posted earlier, but look at it now:
»isc.incidents.org/
and the graph:
»isc.incidents.org/port_details.html?port=137
P.S. It's also being reported in some other newsgroups like Wilders & GRC
--
It takes a disaster to make a woman out of a female
[text was edited by author 2002-09-29 20:19:13] |
|
| reply to dja
said by dja:
For me it's actually increased.
The rate is now (1) request
every 105 seconds.
As before all IPs are unique.
My rate is now approx. the same as yours dja, and , with one noted exception, all unique IPs.
The exception is a machine from my ISP (Optonline)Cable, and my Zone Log Analyzer shows 21 probes from that machine starting @5:15PM EST 2-27-02 till the present. In fact, perhaps coincidently, that was the very first probe of port 137 when this whole thing started.
It's odd that a couple of posters seem to be immune to this problem? Cable vs. DSL? Static vs. Dynamic?
New worm infecting unprotected machines? Grabbing at straws here! Fairly clueless, and certainly no 'Security Expert'.
It doesn't seem to be generating the concern I would have expected? (Though I am by no means suggesting I am panicking;) )
Jack |
|
Occasu$
join:2001-07-20
North Vancouver, BC
| said by JackCam614:
It's odd that a couple of posters seem to be immune to this problem? Cable vs. DSL? Static vs. Dynamic?
New worm infecting unprotected machines?
I remember when the MS-SQL worm first started out (port 1433), the same thing happened. Some were seeing tons of probes and others nothing or slim.
quote:
It doesn't seem to be generating the concern I would have expected? (Though I am by no means suggesting I am panicking )
No reason to be really concerned . Assuming this is a new worm, or variant of an old one, it won't do much if running a firewall. And even if you aren't as long as you dont leave your netbios wide open you won't be infected.... of course this is all conjecture :)
[text was edited by author 2002-09-29 21:00:00] |
|
| reply to JackCam614
Ok - to clarify. I am not getting a lot of the 137 probes. I am see a lot of port 443 and a number of sub7 Trojan port scans. Definitely not what my log usually looks like, just not 137's.
--
It takes a disaster to make a woman out of a female |
|
