TCP packets port 135,137,138,139

Gilion · 10-27-2003, 04:05 AM

In order to log any atack on my box, my firewall is logging dropped packets. This creates huge logs eating al the space on the box, so I disabled some of the logging for some frequently logged packets without knowing what they are.

I was receiving lots of packets on tcp ports 135, 137,138, 139. What are these exactly. I know 135 is used for windows media, and 137, 138, 139 are part of netbios. Should I worry about these packets? I noticed they are all from neighbouring computers.

Gilion

Blindsight · 10-27-2003, 09:11 AM

netbios is a very very noisy service. Most likely it's legitimate traffic if it's from neighboring computers attempting to view your shared files or use your printer, etc. There are nasty viruses that attempt to get in through this method as well. If you don't use samba, it's alright to just DROP packets attempting to hit those ports. 445 is another one. Logging all dropped packets really isn't nessicary unless you're trying to pinpoint a problem or attack of some sort.

Hope this helps.