Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If a computer is communicating with another through UDP port 137, can we assume that it is a host port scan? If YES, how can we identify that and stop it from happening?

share|improve this question
up vote 1 down vote accepted

No, you cannot assume all UDP/137 traffic is a port-scan; that could be legitimate NetBios over TCP/IP traffic.

I have a corporate laptop from my employer, and I am unconnected to the corporate network behind my home firewall. Just over the last hour alone, I have seen over 1000 NBT packets... why? Because windows is broadcasting NBT name queries for a windows domain controller, printers, SMS resources, etc...

NBT Traffic

share|improve this answer
Understood. Thanks mike :) – user136771 May 31 '12 at 23:02

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.