Re: Can anyone guess at this "scan"??

["Laumann, Dave" <[EMAIL PROTECTED]>]

well if the source ports are accurate, then this likely is not netbios-ns
from a windows machine as someone else pointed out. iirc, netbios-ns from
win machines have a source of 137. if there is a nat/firewall/proxy/etc in
between the two machines the source port might change, but a
nat/firewall/proxy device giving src ports < 1024??

as you pointed out, it looks to be a unix host...

-dave

> Hey all,
>
> 	Can someone maybe give me a clue where to dig on
> finding out what
> this type of "scan" is?...whether it's anything known?
>
> 01/09/2001 04:34:36.928 - 	UDP packet dropped -
> Source:other.net.11.66, 928, WAN - 	
> Destination:My.sub.net.162, 137, LAN
> - 	 - 	
> 01/09/2001 04:41:23.416 - 	UDP packet dropped -
> Source:other.net.11.66, 642, WAN - 	
> Destination:My.sub.net.162, 137, LAN
> - 	 - 	
> 01/09/2001 04:50:59.592 - 	UDP packet dropped -
> Source:other.net.11.66, 949, WAN - 	
> Destination:My.sub.net.162, 137, LAN
> - 	 - 	
> 01/09/2001 04:57:10.336 - 	UDP packet dropped -
> Source:other.net.11.66, 690, WAN - 	
> Destination:My.sub.net.162, 137, LAN
> - 	 - 	
> 01/09/2001 05:05:04.480 - 	UDP packet dropped -
> Source:other.net.11.66, 872, WAN - 	
> Destination:My.sub.net.162, 137, LAN