Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If a computer is communicating with another through UDP port 137, can we assume that it is a host port scan? If YES, how can we identify that and stop it from happening?

share|improve this question
up vote 1 down vote accepted

No, you cannot assume all UDP/137 traffic is a port-scan; that could be legitimate NetBios over TCP/IP traffic.

I have a corporate laptop from my employer, and I am unconnected to the corporate network behind my home firewall. Just over the last hour alone, I have seen over 1000 NBT packets... why? Because windows is broadcasting NBT name queries for a windows domain controller, printers, SMS resources, etc...

NBT Traffic

share|improve this answer
    
Understood. Thanks mike :) – user136771 May 31 '12 at 23:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .