Help.. Unwanted network traffic - netbios-ssn port 139

[Guest]

I sniff my network and found that thousands of netbios-ssn traffic
generated by client workstation (W2k Pro). These traffics were desinated to
random network segment through port 139 and it causes heavy
network traffics. Kindly advise how to stop these traffics. Thanks

 

[Jud]

I sniff my network and found that thousands of netbios-ssn traffic
generated by client workstation (W2k Pro). These traffics were desinated to
random network segment through port 139 and it causes heavy
network traffics. Kindly advise how to stop these traffics. Thanks

Port 139 Is the "File and Print Sharing Port, under 2K look in Network
Properties for the Adaptor Properties and untick F A P S, be warned if you
do
they wont be able to share files properly.

Jud

 

[Dave]

if they are random addresses not associated with other machines on your
network you probably want to scan that machine for viruses and worms. many
worms and viruses scan randomly or systematically to various ports looking
for new machines to infect.

 

[Phillip Windell]

"Thousands" really isn't that much. Since things are measured in
Milliseconds, at a rate of once single occurance per millisecond, you can
have a "thousand" things happen in one second. This is usually normal
traffic. Half of Ethernet traffic is this kind of stuff, and on an "idle"
network almost 100% of the traffic is this kind of stuff. You have to
actually examine the details of the packets to see what is really
happening,...simply the fact that they exist doesn't make it a problem.

Most modern Virus/Worms are TCP/IP based not "netbios". I'm not saying you
still couldn't have a problem or that it can't be a Virus/Worm,...I'm just
trying to give it some perspective.