Security Basics mailing list archives
Re: source LAN port 137 dest 169.x
From: "David Nichols" <dnichols () amci com>
Date: Wed, 30 Jul 2003 10:05:06 -0400
Are you running DHCP and is the dest. address 169.254.xxx.xxx? This is Windows default addressing scheme if a computer can't contact a DHCP server. Of course, that doesn't explain why 172.xxx.xxx.xxx is trying to talk to 169.xxx.xxx.xxx, but it would explain where the dest. IP address is coming from. David Nichols Network Admin ----- Original Message ----- From: "Darren Gragg" <admin () bsbks com> To: <security-basics () securityfocus com> Sent: Tuesday, July 29, 2003 11:33 AM Subject: source LAN port 137 dest 169.x I am seeing some UDP packets showing up in my logs as being dropped that have a source of 172 my local subnet with a port of 137 and a destination of a 169.xxx.xxx.xxx address with a port of 137. what would that destination be telling me? Any ideas? Thanks very much in advance Darren Gragg Network Administrator --------------------------------------------------------------------------- ---------------------------------------------------------------------------- --------------------------------------------------------------------------- ----------------------------------------------------------------------------
Current thread:
- source LAN port 137 dest 169.x Darren Gragg (Jul 29)
- RE: source LAN port 137 dest 169.x Kurt (Jul 29)
- RE: source LAN port 137 dest 169.x David Gillett (Jul 30)
- Re: source LAN port 137 dest 169.x James Fields (Jul 30)
- Re: source LAN port 137 dest 169.x David Nichols (Jul 30)
- <Possible follow-ups>
- RE: source LAN port 137 dest 169.x Jason Armstrong (Jul 30)
- RE: source LAN port 137 dest 169.x stephen at unix dot za dot net (Jul 31)
- RE: source LAN port 137 dest 169.x David Gillett (Jul 31)
- RE: source LAN port 137 dest 169.x stephen at unix dot za dot net (Jul 31)
- RE: source LAN port 137 dest 169.x Potter, Tim (Jul 30)
- RE: source LAN port 137 dest 169.x Escue, Robert S CONT (NETS) (Jul 31)