My Damn Firewall Is Getting Hammer By Netbios!

**draqon** · 08-04-2003, 08:39 PM

On my firewall log, it says I got hammer last night like 20 + times by NETBIOS scanning.

**Left_Of_Cool** · 08-04-2003, 10:09 PM

I doubt it, they would probably issue you a subpoena first. Anyone with the slight knowledge of cracking could deploy a simple NetBIOS attack. The rising simplicity of some of these cracking programs is staggering. The RIAA would have enough sense not to try 20+ times if they would at all, they'd rather win in court. Bottom line, KEEP YOUR FIREWALL ON. What kind of firewall are you using, anyway?

**balamm** · 08-05-2003, 12:09 AM

20 attacks is hardly worth noting and is probably a false positive anyway.

When you see 9000 from the same IP, then you could maybe worry enough to post a question about it.

A typical port scan involves ports up to about 5000, so 5000 reports.

20? line noise.

**SeK612** · 08-05-2003, 12:29 AM

I get "Backdoor/SubSeven Trojan horse" and "Default Block NetBus Trojan horse" which is a bit worrying (they're from all over the world) but so far nothing too bad has happened - I'm keeping a close eye on it though

**balamm** · 08-05-2003, 12:34 AM

Those are generally self propagating trojans and they will scan entire ranges of IPs looking for a way in. Nothing to worry about at all if your firewall stops them.
If you see them trying to get out of your system, then that's the time to worry.