Should I be worried?

[M.Siler]

I've been looking at my logs and see the following:

In || Remote: 61.143.182.138 Port 30110 || Local: 192.168.1.105 Port 1026
(nterm)
Out || Remote: 61.143.182.138 Port 137 (netbios-ns) || Local: 192.168.1.105
Port 137 (netbios-ns)

In || Remote: 221.167.0.195 Port 1446 (ora-lm) || Local: 192.168.1.105 Port
27374
Out || Remote: 221.167.0.195 Port 137 (netbios-ns) || Local: 192.168.1.105
Port 137 (netbios-ns)

I've run several port scans aginst me system and they all say that I'm ok,
but what is this outbound traffic on port 137??

 

[Invisibleman www.allexperts.com]

-----Original Message-----
I've been looking at my logs and see the following:

In || Remote: 61.143.182.138 Port 30110 || Local: 192.168.1.105 Port 1026
(nterm)
Out || Remote: 61.143.182.138 Port 137 (netbios-ns) || Local: 192.168.1.105
Port 137 (netbios-ns)

In || Remote: 221.167.0.195 Port 1446 (ora-lm) || Local: 192.168.1.105 Port
27374
Out || Remote: 221.167.0.195 Port 137 (netbios-ns) || Local: 192.168.1.105
Port 137 (netbios-ns)

I've run several port scans aginst me system and they all say that I'm ok,
but what is this outbound traffic on port 137??


.

Port 137 netbios-ns

NetBIOS name service (UDP)

firewalls: Firewall administrators will frequently see
large numbers of incoming packets to port 137. This is due
to the behavior of Windows servers that use NetBIOS (as
well as DNS) to resolve IP addresses to names using the
"gethostbyaddr()" function. As users behind the firewalls
surf Windows-based web sites, those servers will frequently
respond with NetBIOS lookups.

suggest you disable netbios