Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

If a computer is communicating with another through UDP port 137, can we assume that it is a host port scan? If YES, how can we identify that and stop it from happening?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

No, you cannot assume all UDP/137 traffic is a port-scan; that could be legitimate NetBios over TCP/IP traffic.

I have a corporate laptop from my employer, and I am unconnected to the corporate network behind my home firewall. Just over the last hour alone, I have seen over 1000 NBT packets... why? Because windows is broadcasting NBT name queries for a windows domain controller, printers, SMS resources, etc...

NBT Traffic

share|improve this answer
    
Understood. Thanks mike :) –  user136771 May 31 '12 at 23:02

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.