Port scans on port 137 and 17300

[David H. Lipman]

Art:

I told him to just remove "Client for Microsoft Networks" since he does not participate in a
MS Networking LAN.

Dave

 

[null]

Art:

I told him to just remove "Client for Microsoft Networks" since he does not participate in a
MS Networking LAN.

I don't think that closes port 139. If it was that easy, experts
wouldnt bother to write up the rather confusing unbinding procedures
that they have.

Art
http://www.epix.net/~artnpeg

 

[David H. Lipman]

Art:

Yes it is that easy !
I had a Win98SE notebook in front of me. I performed the detailed functions I provided Bill
and rebooted the PC. I then executed TCPView.exe and the TCP and UDP ports for NetBIOS over
IP were not open.

"Please" do NOT proclaim GRC.Com as an "expert", his company is NOT an authorative site for
COMPUSEC.

Dave

| I don't think that closes port 139. If it was that easy, experts
| wouldnt bother to write up the rather confusing unbinding procedures
| that they have.
|
| Art
| http://www.epix.net/~artnpeg

 

[null]

It will close port 139. However, simply removing the MS Client rather
than altering the bindings might create other problems such as the one
described here where DUN passwords can't be saved.

http://support.microsoft.com/support/kb/articles/Q137/3/61.asp

It's a better solution to adjust the bindings.

And leave yourself in a position where you can easily change to a LAN
arrangement later as well (as I understand it).



Art
http://www.epix.net/~artnpeg

 

[* * Chas]

Gus@Sick_of_Spam.au

But you would be better off with a dedicated NAT router rather than relying on
ZA. Firewall software is notoriously unreliable.

J.A. Coutts

John,

I have a DSL modem/router/firewall. When I run netstat -an
with no programs open I get the following results:

Proto Local Address Foreign Address State
TCP 127.0.0.1:1025 0.0.0.0:0
LISTENING
TCP 172.16.1.34:137 0.0.0.0:0
LISTENING
TCP 172.16.1.34:138 0.0.0.0:0
LISTENING
TCP 172.16.1.34:139 0.0.0.0:0
LISTENING
UDP 172.16.1.34:137 *:*
UDP 172.16.1.34:138 *:*

If I launch Kerio Personal Firewall, I get the following
results:

Proto Local Address Foreign Address State
TCP 0.0.0.0:44334 0.0.0.0:0
LISTENING
TCP 0.0.0.0:44334 0.0.0.0:0
LISTENING
TCP 127.0.0.1:1025 0.0.0.0:0
LISTENING
TCP 127.0.0.1:1043 0.0.0.0:0
LISTENING
TCP 172.16.1.34:137 0.0.0.0:0
LISTENING
TCP 172.16.1.34:138 0.0.0.0:0
LISTENING
TCP 172.16.1.34:139 0.0.0.0:0
LISTENING
UDP 0.0.0.0:44334 *:*
UDP 127.0.0.1:1043 *:*
UDP 172.16.1.34:137 *:*
UDP 172.16.1.34:138 *:*

Can you tell me what's going on?

BTW, here's the URL for ARIN WHOIS Database Search to check
out addresses: http://www.arin.net/whois/

 

[Bill Bradshaw]

Here is my latest netstat -an

Active Connections

Proto Local Address Foreign Address State
TCP 127.0.0.1:1025 0.0.0.0:0 LISTENING
TCP 127.0.0.1:8080 0.0.0.0:0 LISTENING

NetBios is gone. All I have left under network is

Dail-Up Adaptor
TCP/IP

Now if somebody can help me figure out port 1025 I will be a happy camper
since we know 8080 is Webwasher.