[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 473
  • Last Modified:

Blocking UDP 137

Hello there!

I have a situation that is somewhat suspicious.  I notice in my router log requests to an outside IP address on UDP port 137 from an XP workstation on my LAN.  

The external IP is from a network that I used to log into via Cisco VPN client software (although the IP address of the PIX I used to log into is not the same as the address in my firewall).

I don't see any Cisco related processes running in task manager.  

I guess my question is two-fold:

1.  How can I track down the process that is generating these requests

2.  How can I use netsh to block the requests

Thanks in advance!
0
ttist25
Asked:
ttist25
1 Solution
 
naveedbCommented:
To see which application is trying to connect, download the following software and run it on the workstation;

http://www.sysinternals.com/Utilities/TcpView.html

Most likely, the workstations is tryint to do NetBIOS name resolution. If you are using pure windows XP environment, you can disable Netbios resolution by going into Advanced TCP/IP properties under WINS.

The better method however would be to block it on the firewall.
0
 
ttist25Author Commented:
Thanks naveedb.  That seems to have stopped the requests.  I can't figure out what process is causing it to call out though.  

0

Featured Post

New Tabletop Appliances Blow Competitors Away!

WatchGuard’s new T15, T35 and T55 tabletop UTMs provide the highest-performing security inspection in their class, allowing users at small offices, home offices and distributed enterprises to experience blazing-fast Internet speeds without sacrificing enterprise-grade security.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now