I noticed similar port 137 hits a while back, and after a bit of investigating discovered that every time a colleague visited a web site (using Netscape, incidentally) the server sent a port 137 request back to the client PC. Initially I thought this was a "helpful" MS extension in their server, but have since seen port 137 hits from their nameservers as well. This probably points to some interesting name lookups going on at there end, which results in a NetBIOS name lookup being sent back. Somewhere I have the address of the server in question - I'll dig it out if there is interest. If nothing else, their hit count will go up ;-) Paul -- Paul Thornton, Network Engineer, London Internet Exchange Ltd. Tel: 07000 783797 Mobile: +44 467 372205
One interesting thing MS does is an extension of the resolver libraries. For example, if I do a netstat -a to show all the connections on my server, it will try and resolve the IP back to a name (reverse lookup via in-addr.arpa). However, the extension is: If it can't resolve it via DNS, it will attempt to look it up using NetBIOS name resolution lookups. If its a Windoze environment (95, NT), the client will return its host name. My guess on this one: Their hitting an NT webserver configured to log names, not IP addresses, in the log file and the client machines don't have IN-ADDR.ARPA entries. Two other thoughts: 1) Keep IN-ADDR.ARPA up to date 2) Microsoft Internet Information Server only logs IP addresses, not names given the historical slowness of reverse lookups and sloppy maintenance. I never understood why forward and reverse maps were decoupled in DNS, although I'm sure a good reason exists. Process Software Purveyor logs by name (or did) and I'm not sure about Netscape's servers now. My $0.02 Eric At 02:24 PM 1/7/98 +0000, Paul Thornton wrote:
I noticed similar port 137 hits a while back, and after a bit of investigating discovered that every time a colleague visited a web site (using Netscape, incidentally) the server sent a port 137 request back to the client PC.
Initially I thought this was a "helpful" MS extension in their server, but have since seen port 137 hits from their nameservers as well. This probably points to some interesting name lookups going on at there end, which results in a NetBIOS name lookup being sent back. Somewhere I have the address of the server in question - I'll dig it out if there is interest. If nothing else, their hit count will go up ;-)
Paul
-- Paul Thornton, Network Engineer, London Internet Exchange Ltd. Tel: 07000 783797 Mobile: +44 467 372205
============================================================================ ==== Eric Germann Computer and Communications Technologies ekgermann@cctec.com Van Wert, OH 45891 Phone: 419 968 2640 http://www.cctec.com Fax: 419 968 2641 Network Design, Connectivity & System Integration Services A Microsoft Solution Provider
participants (2)
-
Eric Germann -
Paul Thornton