This has been pretty common for quite some time, and has probably increased due to attendant publicity surrounding the following: http://www.securityfocus.com/frames/?content=/vdb/bottom.html%3Fvid%3D1620 "Roeland M.J. Meyer" wrote:
From: John Fraizer [mailto:nanog@EnterZone.Net] Sent: Wednesday, September 27, 2000 11:26 AM
On Wed, 27 Sep 2000, Bill Becker wrote:
Speaking of the internet and the way it operates, is anyone else seeing a large number of random hosts scanning through their address space using TCP on port 139?
Bill
We have been seeing this for about 3 weeks now.
I have too, it looks like they're looking for Windoze and Samba boxen. That's one of the netbios ports.
-- ------------------------------------------------------------ Roland Dobbins <rdobbins@netmore.net> // 818.535.5024 voice