I found these outgoing UDP traffics to port 137 of external machines in logs of CIS firewall. I learned that port 137 is used for file sharing in Windows. It seems that it is unusual to have that kind of outgoing traffics to external computers. Is these signs that my PC is infected?
08/12/09 11:02:01 System Blocked 192.168.0.2 137 208.116.13.67 137 UDP
08/12/09 11:02:04 System Blocked 192.168.0.2 137 208.116.13.67 137 UDP
08/12/09 11:13:27 System Blocked 192.168.0.2 137 202.68.197.18 137 UDP
08/12/09 11:13:30 System Blocked 192.168.0.2 137 202.68.197.18 137 UDP
08/12/09 11:13:32 System Blocked 192.168.0.2 137 202.68.197.18 137 UDP
08/12/09 11:13:35 System Blocked 192.168.0.2 137 202.68.197.18 137 UDP
08/12/09 11:17:39 System Blocked 192.168.0.2 137 198.87.182.188 137 UDP
08/12/09 11:17:42 System Blocked 192.168.0.2 137 198.87.182.188 137 UDP
08/12/09 11:17:44 System Blocked 192.168.0.2 137 198.87.182.188 137 UDP
08/12/09 11:17:47 System Blocked 192.168.0.2 137 198.87.182.188 137 UDP
08/12/09 11:41:55 System Blocked 192.168.0.2 137 208.67.216.230 137 UDP
08/12/09 11:41:58 System Blocked 192.168.0.2 137 208.67.216.230 137 UDP
Hi, these are normal NetBIOS broadcasts, however, if you’re not part of a LAN and have no requirement for file of printer sharing, you may disable NetBIOS on you network adapter.
Open the properties for your network adapter, untick the boxes on Client for Microsoft Networks and File and Print sharing for Microsoft Networks. Next select Internet protocol V4 and select properties, select Advanced and then WINS. At the bottom of the window click the radio button to Disable NetBIOS over TCP/IP.
I use file sharing on my Home LAN, so I do not want to disable Client for Microsoft Networks. I think it may be normal for just broadcasting within a LAN.
However, I’m still wonder why my PC send those outgoing traffic to those IP 208.116.13.67…198.87.182.188…
How my PC get these IP address?
It seems it is too danger to broadcasting file sharing to THE WORLD. How can this be a normal system behaviour?
It seems it is too danger to broadcasting file sharing to THE WORLD. How can this be a normal system behaviour?
NetBIOS likes to be friendly and tell the world all about itself. What you’re seeing is NetBIOS Name Service, which is a broadcast announcement to everything it can reach, unless you control it.
As you need file sharing you could create a new trusted network, stealth my ports to everyone else. This will create two global rules and two system object rules that allow all devices within the same IP address to communicate.
Once done, you could create a separate block rule on the system object for UDP Out port 137.