by mail.netbsd.org with SMTP; 11 Sep 2000 15:48:05 -0000
	id B456C7B3; Mon, 11 Sep 2000 17:47:03 +0200 (CEST)
Date: Mon, 11 Sep 2000 17:47:03 +0200
From: Mipam <mipam@ibb.net>
To: Tony Hernadez <tony@cne-inc.com>
Cc: "'tech-security@netbsd.org'" <tech-security@netbsd.org>
Subject: Re: random connections on TCP port: 139
Message-ID: <20000911174703.D315@ibb0021.ibb.uu.nl>
Reply-To: mipam@ibb.net
References: <E10D54F27C6AD11196EF00600812C5CF067EA8@CNENT>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.2.5i
In-Reply-To: <E10D54F27C6AD11196EF00600812C5CF067EA8@CNENT>; from tony@cne-inc.com on Mon, Sep 11, 2000 at 11:49:47AM -0400

On Mon, Sep 11, 2000 at 11:49:47AM -0400, Tony Hernadez wrote:
> Can someone shine some light on why my server is always getting netbios
> connections from random computers on atlantic.net's dial up lines ? here are
> some clips:
> 
> attackalert: Connect from host: jcvmfl-as-1-ip-41.atlantic.net/209.208.19.72
> to TCP port: 139
> attackalert: Connect from host:
> mtldfl-as-3-ip-08.atlantic.net/209.208.45.135 to TCP port: 139
> attackalert: Connect from host:
> ocalflifanb-as-2-r1-ip-583.atlantic.net/209.208.10.75 to TCP port: 139
> attackalert: Connect from host: jcvmfl-as-1-ip-42.atlantic.net/209.208.19.73
> to TCP port: 139
> 
> I really do not think that these are actually attacks on this server but..
> It is getting annoying. Anyone run into something like this?
> 

Sure, sure, every day i guess.
So many m$ crapware machine on the net is the reason if you ask me.
Why to try to talk to our network on port 139 i dont know, but i guess
its a habit of m$ systems.
Anyway, i blocked this allrdy on the router. So no such traffic actually gets
in. 
Bye,

Mipam.