Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 9 replies
  • Subscribers 2 subscribers
  • Views 3016 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Should I be worried? Severity="info" NBNS

Astaronator
So I have tons of these packets logged.

The machine is trying to connect through a NIC that is local only (no gateway) to port 137 on external IP addresses. I will contact the software manufacturer, but what is the threat of these packets?

Does the fact that the Astaro (v7.505) states severity="info" mean that this is just making me aware? If this was a threat would the severity value change?

Thanks!
-Nator


This thread was automatically locked due to age.
Parents
  • 0
    My guess...  If the 'dstip' is the same in every blocked packet, the device at 192.168.1.105 is misconfigured to think that it can get NETBIOS name resolution from outside.  If the destination IP changes, the device at 192.168.1.105 probably was infected by a Trojan and is now a member of a netbot army.[;)]

    Cheers - Bob
Reply
  • 0
    My guess...  If the 'dstip' is the same in every blocked packet, the device at 192.168.1.105 is misconfigured to think that it can get NETBIOS name resolution from outside.  If the destination IP changes, the device at 192.168.1.105 probably was infected by a Trojan and is now a member of a netbot army.[;)]

    Cheers - Bob
Children
No Data