[Scottish] The yellow peril?

[Gordon JC Pearce]

> All the 'scans' to port 135 or 139 are NetBIOS - whether they're misconfigured
> Windows boxes automatically scanning for shares or spammers trying to use the
> winpopup messaging system isn't clear, but I'm guessing that there's an
> awful lot of random NetBIOS traffic out there, since Windows seems to 
> automatically advertise its presence to the internet every few minutes. 

What is interesting is if you try to connect to some of the machines,
quite often you can mount their SMB shares over the 'net!

smbclient \\\\<ipaddress>\\ -L <ipaddress> -N to get a list of available
shares.