Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 3 replies
  • Subscribers 2 subscribers
  • Views 3196 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Netbios intrusion attempt

Raptor34
Hi.
I receiece alot of this meesages from my intrusion protection system on asl 5.202.

[1:2924:0] A NETBIOS SMB-DS repeated logon failure [Classification: Unsuccessful User Privilege Gain] [Priority: 1]:  {PROTO006}

The ip is from my webserver on dmz and to a computer on my lan.

What is this? anyone..

regards Lars


This thread was automatically locked due to age.
  • 0
    this means that your ips has realized an logon attamp from your dmz pc to your lan pc.
    you have to fine tune your ips settings (exclusions, etc.).
    also take in mind that there are a lot of false positives. so it takes a while till ips is configured well.
    also check whether you really need smb from dmz to your lan.
  • 0 in reply to bce
    thx for answer
    there is no traffic allowed from dmz to lan.
    but i think maybe this is related to som logging software on webserver....

    I will investigate furter[:)]

    Rapt
  • 0 in reply to Raptor34
    Remeber to consider disabling administrative share on dmz if not necessary other than limit ms protocol (smb,445,134 an other...).