[Snort-users] netbios-name-query

Robert L. Yelvington robert at ...579...
Fri Jun 8 13:54:18 EDT 2001


I run snort 1.7 w/vision.conf from whitehats.com on fBSD 4.3 machine,
runs like a champ w/no probs!

I have recently, say within the last month, noticed an unusual amount of
'netbios-name-query' (port 137) scans
on my machine...at least 4/5 a day.

Should I be worried about this?

The scans are rarely across more than a couple of IPs in my /26 address
space and mostly originate from some dsl or cable
provider's network.

Has anyone else noticed this?  OR can someone provide comments?

thanx,
~rob




More information about the Snort-users mailing list