Its certainly netbios!!
Yes, it is. Since 137 is netbios name-server I guess it could be that the MTA tries to find out who you are. sendmail does the same, so why should M$ don't do it? Philipp
Whenever I send email to a specific server, the server trys to connect to my server on port 137.
I don't know, but you can see : (for colsfaq)
5.7) I'm seeing repeated probes to port xxxx... What does this mean?
Here are some lists of port assignments:
IANA Port Assignments : http://www.isi.edu/in-notes/iana/assignments/port-numbers - "Official" port assignment from the Internet Assigned Numbers Authority.
Port list at NetworkIce: http://advice.networkice.com/advice/Exploits/Ports - List of ports and hyperlinked explanations that includes 'less standard' ports.
List of Trojans: http://www.tlsecurity.com/trojanh.htm - The most complete list of trojan ports available.
Port Search Engine: http://www.cotse.com/cgi-bin/port.cgi - Very nice search engine for ports, links results to relevant RFC's.
For a more in depth analysis of what you're seeing, see Robert Graham's Firewall forensics FAQ: http://www.robertgraham.com/pubs/firewall-seen.html
Any ides what is going on there? Is that one misconfigured? I mean I could sniff that traffic and see what it is, but does anybody know what it is and why?
To unsubscribe, e-mail: suse-security-unsubscribe@suse.com For additional commands, e-mail: suse-security-help@suse.com