Blocked NetBIOS Datagram?

[Kaido]

I've gotten a couple alerts from ZoneAlarm this morning:

"The firewall has blocked Internet access to your computer (NetBIOS datagram) from 169.254.124.185 (NetBIOS Datagram)"

Any idea what that means? Never gotten a popup like that before. I'm running a Linksys WRT54GS plus ZoneAlarm/AVG on my PCs. Am I being haxored?? :Q

 

[n0cmonkey]

Someone at 169.254.124.185 is trying to access your machine through NetBIOS (a protocol that Microsoft used to use for file sharing). ZA stopped it.

 

[Kaido]

Originally posted by: n0cmonkey
Someone at 169.254.124.185 is trying to access your machine through NetBIOS (a protocol that Microsoft used to use for file sharing). ZA stopped it.

I thought the router's firewall took care of that stuff

 

[n0cmonkey]

Originally posted by: Kaido

Originally posted by: n0cmonkey
Someone at 169.254.124.185 is trying to access your machine through NetBIOS (a protocol that Microsoft used to use for file sharing). ZA stopped it.

I thought the router's firewall took care of that stuff

Maybe they're on the inside. *cue creepy music*

It should, not sure why that got through.

 

[Kaido]

Originally posted by: n0cmonkey

Originally posted by: Kaido

Originally posted by: n0cmonkey
Someone at 169.254.124.185 is trying to access your machine through NetBIOS (a protocol that Microsoft used to use for file sharing). ZA stopped it.

I thought the router's firewall took care of that stuff

Maybe they're on the inside. *cue creepy music*

It should, not sure why that got through.

Just got my third (blocked) hit...

 

[nweaver]

isn't that an autoconfig IP too?

 

[n0cmonkey]

Originally posted by: nweaver
isn't that an autoconfig IP too?

I noticed that, but I don't know if there are any special routing rules involved with that.

Maybe there's a wireless connection and someone accidentally connected to it without activating the connection and this is just general broadcast traffic.

 

[futuristicmonkey]

Originally posted by: n0cmonkey

Originally posted by: nweaver
isn't that an autoconfig IP too?

I noticed that, but I don't know if there are any special routing rules involved with that.

Maybe there's a wireless connection and someone accidentally connected to it without activating the connection and this is just general broadcast traffic.

Yeah that shouldn't be happening.

Note that the computer cannot communicate with computers on other subnets, or with computers that do not use automatic private IP addressing. Automatic private IP addressing is enabled by default.

Though, it is netbios -- it's probably just giving an ip address for shits and giggles, leaving it to you to determine which box it is.

 

[Kaido]

Latest: "The firewall has blocked Internet access to 192.168.2.1 (NetBIOS Session) from your computer [TCP Flag: S]."

Huh, .2.1?

 

[spidey07]

Nothing to worry about, all completely normal.

 

[Kaido]

Originally posted by: spidey07
Nothing to worry about, all completely normal.

I've been running the same setup for years...Linksys/ZoneAlarm/AVG...never once have I gotten popups like this. You sure?

 

[gsellis]

NetBIOS can also be used for Browser messages (no, not web browsers). You running XP with NetBIOS enabled or have W2K/Win9X/WinME/WinNT machines on the network? You also see port 138/139 traffic just trying to figure who the neighbors are so that if you want to look at My Network Neighborhood, they can answer. See it all the time in CSA when we are in "shields up" mode. If you are seeing it on the otherside of your cable/DSL connection, some idiot is attached directly into their modem without a Firewall. Probably will be part of a botnet someday