[Wolves] Any Idea whats going on?

[David Goodwin]

Peter Cannon wrote:
> Hi All
> 
> Am I being attacked/probed?
> 
> I'm no firewall/network expert, but I've just had this log message and 
> everyone is out here at the moment so I cant ask my guys whats going on.
> 
> Am I being paranoid?
> 
> I've not seen this before, any ideas?
> 
Hi,

Port 137 is one of the Microsoft networking things (netbios-ns)
so it's probable that windows computers are trying to ask you for name 
lookups.

> Logged 120 packets on interface eth0
>   From 192.168.10.13 - 12 packets to udp(137)
>   From 192.168.10.16 - 3 packets to udp(32922)
>   From 192.168.10.17 - 6 packets to udp(137)
>   From 192.168.10.19 - 12 packets to udp(137)
>   From 192.168.10.22 - 12 packets to udp(137)
>   From 192.168.10.67 - 12 packets to udp(137)
>   From 192.168.10.70 - 3 packets to udp(137)
>   From 192.168.10.82 - 12 packets to udp(137)
>   From 192.168.10.140 - 12 packets to udp(137)
>   From 192.168.10.169 - 12 packets to udp(137)
>   From 192.168.10.180 - 12 packets to udp(137)
>   From 192.168.10.253 - 12 packets to udp(137)
> 
> I've looked them up on ARIN WHOIS and they are in the USA
> 
192.168.X.X is an internal network (class C). It's probably your 
internal LAN

David.


-- 
David Goodwin
w: http://www.clocksoft.com
e: david.goodwin at clocksoft.com
t: 0121 313 3850

See http://www.PayThyme.com for an Open Source UK Payroll