Local access violation on QNAP via local LAN

I have my QNAPs locked down in System Administration > Security > Security Level to High where only my internal network was allowed to access the QNAP. Then I received an access violation email and an external IP trying to access it via Port 1900 (deals with UPnP service). This caused me to be concerned so I went through my firewall and blocked some rouge IPs and turned the UPnP service off on the QNAP. After I did that, I went ahead and limited the access to the QNAP so that only administrator workstations and servers could access the QNAP instead of allowing the whole network.

Now I receive access violations from IPs on my own LAN on port 139 (NetBIOS). No machines need to have access to the QNAP as they are used as backup devices via iSCSI connections. I'm not sure what to make of this. It comes from random machine at random times. I talk to users and they have no knowledge of anything about it. Is this something I should be worried about? I just worry that a hacker is using NetBIOS and trying to gain access. Any ideas or experience on the issue is much appreciated.
Bubba-QLPAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

ChiefITCommented:
Netbios is a broadcast protocol, and not used for authorization. Instead these broadcasts are used for populating files and printers in the browselist.

I think I would throw wire shark on there and monitor netbios port 139. Something seems ammis.

Do you use a WINS server?

Maybe the WINS service has the wrong logon credentials to it or the WINS database has the wrong ACL.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Bubba-QLPAuthor Commented:
I don't use a WINS Server. However, when I go under my NIC settings, I see that under the WINS tab, the NetBIOS Setting is set to Default. Every machine on our network is set statically so this is enabled. Do you think that this could be the culprit?
0
ChiefITCommented:
Yes,

Also consider the fact that firewalls usually prevent Netbios broadcasts.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Internet Protocols

From novice to tech pro — start learning today.