[plug] NT netbios-ns probes

Christian christian at global.net.au
Mon Feb 7 16:56:58 WST 2000


Hi all,

Sorry that this is a little off-topic but does anyone know why NT web
servers appear to send out netbios-ns (port 137/udp) probes when you
download web pages from them?  

Feb  7 16:52:28 machine kernel: Packet log: input DENY eth0 PROTO=17
1.2.3.4:137 5.6.7.8:137 L=78 S=0x00 I=32689 F=0x0000 T=115 (#34)  
Feb  7 16:52:29 machine kernel: Packet log: input DENY eth0 PROTO=17
1.2.3.4:137 5.6.7.8:137 L=78 S=0x00 I=33457 F=0x0000 T=115 (#34)  

(IP addresses changed to protect the "innocent".)

I can't really understand any reasoning for this, Apache certainly
doesn't do it and I've never seen other web servers do it either... Can
anyone provide any clues?

Regards,

Christian.



More information about the plug mailing list