[31542] in North American Network Operators' Group
RE: Port 139 scans
daemon@ATHENA.MIT.EDU (Roeland M.J. Meyer)
Wed Sep 27 17:39:36 2000
Message-ID: <1148622BC878D411971F0060082B042C372E@hawk.lvrmr.mhsc.com>
From: "Roeland M.J. Meyer" <rmeyer@MHSC.com>
To: John Fraizer <nanog@EnterZone.Net>,
Bill Becker <bbecker@iconn.net>
Cc: nanog@merit.edu
Date: Wed, 27 Sep 2000 14:36:58 -0700
MIME-Version: 1.0
Content-Type: text/plain
Errors-To: owner-nanog-outgoing@merit.edu
> From: John Fraizer [mailto:nanog@EnterZone.Net]
> Sent: Wednesday, September 27, 2000 11:26 AM
>
> On Wed, 27 Sep 2000, Bill Becker wrote:
>
> > Speaking of the internet and the way it operates, is anyone
> else seeing a
> > large number of random hosts scanning through their address
> space using TCP
> > on port 139?
> >
> > Bill
>
> We have been seeing this for about 3 weeks now.
I have too, it looks like they're looking for Windoze and Samba boxen.
That's one of the netbios ports.
