port 139 scans?
James Cronin
james at unfortu.net
Wed Feb 13 11:48:54 UTC 2002
Port 139's the netbios port.
Is the source address in NTL's 80.0.0.0/13 allocation? They're
using those IPs for their broadband always on cable modem customers.
So it's either some idiot script kiddies running port scanners themselves
or unfirewalled fools who've had their Windows boxes hacked.
J.
x
> Is anyone else seing lots of packets being thrown at port 139?
>
> We're getting 5 or 6 packets a sec, mostly from 80.0.0.0/8 (and all tcp
> syn's).
>
> --
> Internet Vision Internet Consultancy Tel: 020 7589 4500
> 60 Albert Court & Web development Fax: 020 7589 4522
> Prince Consort Road vision at ivision.co.uk
> London SW7 2BE http://www.ivision.co.uk/
>
More information about the NANOG
mailing list