Re: Port 139 scans

I am particularly concerned over this issue of these broadcasts originating from Concentric.net

I don't think they particularly are. Here at lbl.gov (128.3/16), we're getting scanned from cmu.edu (128.2/16). nersc.gov (128.55/16) is getting scanned from ucsd.edu (128.54/16). So it could well be that the ones being scanned from concentric.net are simply those with nearby address blocks, and it's just one small part of rampant scanning from all over the place. By the way, we identified a couple instances of the virus that Ken Lindahl mentioned in his earlier post. Vern