UDP Port 137

Common Use

Netbios Name Service is typically how Windows computers find out information concerning the networking features offered by a computer, such as System Name, File Shares, etc.

Inbound Scan

Inbound scans can be the result of everything from a harmless Reverse DNS lookup to a malicious scan for the availability of open shares to exploit.  Currently most inbound scans are the result of a number of worms such as BugBear and Opaserv which exploit open file shares to propagate.

Outbound Scan

Outbound scans if occurring in volume should be considered an indication of a possible worm infection on the source computer and should be investigated.

Additional Information

A Day and a Night with PortPeeker and UDP port 137

Port 137 Scans or 'Intro to Basic Forensics'

Link Logger inbound scans/attack report for selected ports from one of our test systems.  NOTE the reported system would be typical for high speed home users.

Link Logger unique source IP addresses per hour for selected ports from one of our test systems.  NOTE the reported system would be typical for high speed home users.

Page last updated on February 16, 2004