Actually, probes to the range of 137-139 aren't that unusual.
netbios-ns 137/tcp #NETBIOS Name Service netbios-ns 137/udp #NETBIOS Name Service netbios-dgm 138/tcp #NETBIOS Datagram Service netbios-dgm 138/udp #NETBIOS Datagram Service netbios-ssn 139/tcp #NETBIOS Session Service netbios-ssn 139/udp #NETBIOS Session Service
For the most part, they are ill-configured Window$ boxes that are looking for hosts via netBIOS, outward onto the Internet during bootup. (They should only be looking within their local network neighborhood.)
But this is the first time I've seen something like this...
Unusual System Events =-=-=-=-=-=-=-=-=-=-=
snort:
Feb 20 05:45:44 greatwall snort: [1:0:0] UDP to 137 netBIOS ns {UDP}
169.254.121.26:137 -> 12.82.128.114:137
Feb 20 05:45:44 greatwall snort: [1:0:0] UDP to 137 netBIOS ns {UDP}
211.228.134.118:137 -> 12.82.128.114:137
Feb 20 05:45:45 greatwall snort: [1:0:0] UDP to 137 netBIOS ns {UDP}
211.228.134.118:137 -> 12.82.128.114:137
Feb 20 05:45:45 greatwall snort: [1:0:0] UDP to 137 netBIOS ns {UDP}
169.254.121.26:137 -> 12.82.128.114:137
So basically you've got two widely separated hosts doing netBIOS nameservice requests of me, on my dynamic IP address, simultaneously.
What's the full snort log?
02/20-05:45:44.299243 169.254.121.26:137 -> 12.82.128.114:137 UDP TTL:111 TOS:0x0 ID:55568 IpLen:20 DgmLen:78 Len: 58 24 35 00 10 00 01 00 00 00 00 00 00 20 43 4B 41 $5.......... CKA 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 41 41 41 41 41 41 41 41 41 41 41 41 41 00 00 21 AAAAAAAAAAAAA..! 00 01 .. =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ 02/20-05:45:44.319230 211.228.134.118:137 -> 12.82.128.114:137 UDP TTL:110 TOS:0x0 ID:55569 IpLen:20 DgmLen:78 Len: 58 24 37 00 10 00 01 00 00 00 00 00 00 20 43 4B 41 $7.......... CKA 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 41 41 41 41 41 41 41 41 41 41 41 41 41 00 00 21 AAAAAAAAAAAAA..! 00 01 .. =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ 02/20-05:45:45.799431 211.228.134.118:137 -> 12.82.128.114:137 UDP TTL:110 TOS:0x0 ID:55572 IpLen:20 DgmLen:78 Len: 58 24 39 00 10 00 01 00 00 00 00 00 00 20 43 4B 41 $9.......... CKA 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 41 41 41 41 41 41 41 41 41 41 41 41 41 00 00 21 AAAAAAAAAAAAA..! 00 01 .. =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ 02/20-05:45:45.809445 169.254.121.26:137 -> 12.82.128.114:137 UDP TTL:111 TOS:0x0 ID:55573 IpLen:20 DgmLen:78 Len: 58 24 3B 00 10 00 01 00 00 00 00 00 00 20 43 4B 41 $;.......... CKA 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 41 41 41 41 41 41 41 41 41 41 41 41 41 00 00 21 AAAAAAAAAAAAA..! 00 01 .. <snip>
That $;..........CKAAAAAAAAAAAAAAAAAAAAAAAAAA..! stuff looks like normal (if that's the word..) M$ netBIOS stuff..
OK... Whois these guys? (heh..)
BW whois 2.9 by Bill Weinman (http://whois.bw.org/)
© 1999-2001 William E. Weinman
IANA (NETBLK-LINKLOCAL)
Internet Assigned Numbers Authority
4676 Admiralty Way, Suite 330
Marina del Rey, CA 90292-6695
US
Netname: LINKLOCAL
Netblock: 169.254.0.0 - 169.254.255.255
Coordinator:
Internet Corporation for Assigned Names and Numbers (IANA-ARIN) res-ip@iana.org
(310) 823-9358
Domain System inverse mapping provided by:
BLACKHOLE-1.IANA.ORG192.0.32.18
BLACKHOLE-2.IANA.ORG192.0.32.19
hmm.. the BLACKHOLE-1.IANA.ORG192.0.32.18 DNS notation usually means that the IP range is assigned to some private, non-routable usage...
Netname: LINKLOCAL?
Off to google...
Here's one reference at www.ietf.org
"This document describes a method by which a host may automatically configure an interface with an IPv4 address in the 169.254/16 prefix that is valid for link-local communication on that interface. This is especially valuable in environments where no other configuration mechanism is available. 2.5 Link-Local Addresses Are Not Forwarded Any host sending an IPv4 packet with a source and/or destination address in the 169.254/16 prefix MUST set the TTL in the IP header to 255. Any host receiving an IPv4 packet whose source and/or destination address is in the 169.254/16 prefix MUST discard the packet if the TTL in the IP header is not 255. This is to guard against misconfigured routers which may allow packets to leak in from outside the local link. Since even the most dysfunctional router will decrement the TTL in the IP header, a host receiving a packet with a TTL less than 255 can detect that it originated outside the local link. An IPv4 packet whose source and/or destination address is in the 169.254/16 prefix MUST NOT be sent to any router for forwarding, and any network device receiving such a packet MUST NOT forward it, regardless of the TTL in the IP header.
(My emphasis)
So that's a little puzzling: how did these 169.254.121.26-sourced packets *get* here?
Maybe too many routers are not configured properly for such "modern" stuff...
And look at the TTL's of all of 'em: 111 for the 211.228.x.x's and 110 for the 169.254.x.x's -- if these were legitimate packets, shouldn't they have decremented from 255?
Here's another reference, at Micro$oft..
"In Windows Me, you can use the Automatic Private IP Addressing feature of Transmission Control Protocol/Internet Protocol (TCP/IP) to assign a unique Internet protocol (IP) address to a network adapter. This may be useful if you have a small network that does not have a DHCP server. With automatic private IP addressing, you can assign a unique IP address to your network adapter by using the LINKLOCAL network IP address space. LINKLOCAL network addresses always begin with the numbers 169.254 and have the following format:
169.254.X.X
"LINKLOCAL network addresses are used only for private, internal addresses,and are not valid for host computers that are "visible" on the Internet. They cannot be used for computers that are linked by Internet Connection Sharing (ICS)."
"With automatic IP addressing, the IP address can be configured automatically. This method decreases administration time and means that IP addresses can be reused. Also, this method is recommended for all sizes of networks that do not have a direct Internet connection or available DHCP service."
Whois dat?
BW whois 2.9 by Bill Weinman (http://whois.bw.org/) © 1999-2001 William E. Weinman % Rights restricted by copyright. See http://www.apnic.net/db/dbcopyright.html % (whois7.apnic.net) inetnum: 211.226.0.0 - 211.231.255.255 netname: KORNET descr: KOREA TELECOM descr: KOREA TELECOM Internet Operating Center country: KR admin-c: DL276-AP tech-c: WK81-AP remarks: ****************************************** remarks: Allocated to KRNIC Member. remarks: If you would like to find assignment remarks: information in detail please refer to remarks: the KRNIC Whois Database at: remarks: http://whois.nic.or.kr/english/index.html remarks: ****************************************** # ENGLISH IP Address : 211.228.128.0-211.228.139.255 Network Name : KORNET-XDSL-KUMI Connect ISP Name : KORNET Connect Date : 20010602 Registration Date : 20010604 [ Organization Information ] Orgnization ID : ORG201037 Org Name : KUMI NODE State : KYONGBUK Address : 48 SONGJEONGDONG KUMISI Zip Code : 730-090 [ Admin Contact Information] Name : GilSoon Park Org Name : KOREA TELECOM State : SEOUL Address : 128-9 Youngundong Chongroku Zip Code : 110-460 Phone : +82-2-747-9213 Fax : +82-2-766-5901 E-Mail : gspark@kornet.net [ Technical Contact Information ] Name : Won Kang Org Name : KOREA TELECOM State : SEOUL Address : 128-9 Youngundong Chongroku Zip Code : 110-460 Phone : +82-2-747-9213 Fax : +82-2-766-5901 E-Mail : ip@ns.kornet.net
OK: I don't mean to be weird, but a *lot* of funky stuff comes out of Korea...
...so is this just netBIOS/Micro$oft-linklocal weirdness, or
Feb 20 05:45:47 greatwall snort: [1:0:0] UDP to 137 netBIOS ns {UDP}
169.254.121.26:137 -> 12.82.128.114:137
Feb 20 05:45:47 greatwall snort: [1:0:0] UDP to 137 netBIOS ns {UDP}
211.228.134.118:137 -> 12.82.128.114:137
Feb 20 05:45:48 greatwall snort: [1:0:0] UDP to 137 netBIOS ns {UDP}
169.254.121.26:137 -> 12.82.128.114:137
Feb 20 05:45:48 greatwall snort: [1:0:0] UDP to 137 netBIOS ns {UDP}
211.228.134.118:137 -> 12.82.128.114:137
Feb 20 05:45:50 greatwall snort: [1:0:0] UDP to 137 netBIOS ns {UDP}
211.228.134.118:137 -> 12.82.128.114:137
Feb 20 05:45:50 greatwall snort: [1:0:0] UDP to 137 netBIOS ns {UDP}
169.254.121.26:137 -> 12.82.128.114:137
Feb 20 05:45:51 greatwall snort: [1:0:0] UDP to 137 netBIOS ns {UDP}
169.254.121.26:137 -> 12.82.128.114:137
Feb 20 05:45:51 greatwall snort: [1:0:0] UDP to 137 netBIOS ns {UDP}
211.228.134.118:137 -> 12.82.128.114:137
Feb 20 05:50:19 greatwall snort: [1:0:0] UDP to 137 netBIOS ns {UDP}
169.254.121.26:137 -> 12.82.128.114:137
Feb 20 05:50:19 greatwall snort: [1:0:0] UDP to 137 netBIOS ns {UDP}
211.228.134.118:137 -> 12.82.128.114:137
Feb 20 05:50:21 greatwall snort: [1:0:0] UDP to 137 netBIOS ns {UDP}
211.228.134.118:137 -> 12.82.128.114:137
Feb 20 05:50:21 greatwall snort: [1:0:0] UDP to 137 netBIOS ns {UDP}
169.254.121.26:137 -> 12.82.128.114:137
Feb 20 05:50:22 greatwall snort: [1:0:0] UDP to 137 netBIOS ns {UDP}
169.254.121.26:137 -> 12.82.128.114:137
Feb 20 05:50:22 greatwall snort: [1:0:0] UDP to 137 netBIOS ns {UDP}
211.228.134.118:137 -> 12.82.128.114:137
Feb 20 05:50:24 greatwall snort: [1:0:0] UDP to 137 netBIOS ns {UDP}
169.254.121.26:137 -> 12.82.128.114:137
Feb 20 05:50:24 greatwall snort: [1:0:0] UDP to 137 netBIOS ns {UDP}
211.228.134.118:137 -> 12.82.128.114:137
Feb 20 05:50:25 greatwall snort: [1:0:0] UDP to 137 netBIOS ns {UDP}
211.228.134.118:137 -> 12.82.128.114:137
Feb 20 05:50:25 greatwall snort: [1:0:0] UDP to 137 netBIOS ns {UDP}
169.254.121.26:137 -> 12.82.128.114:137
Feb 20 05:50:27 greatwall snort: [1:0:0] UDP to 137 netBIOS ns {UDP}
169.254.121.26:137 -> 12.82.128.114:137
Feb 20 05:50:27 greatwall snort: [1:0:0] UDP to 137 netBIOS ns {UDP}
211.228.134.118:137 -> 12.82.128.114:137
ipchains for the entire event:
Feb 20 05:45:44 greatwall kernel: Packet log: input DENY ppp0 PROTO=17 169.254.121.26:137 12.82.128.114:137 L=78 S=0x00 I=55568 F=0x0000 T=111 (#26) Feb 20 05:45:44 greatwall kernel: Packet log: input DENY ppp0 PROTO=17 211.228.134.118:137 12.82.128.114:137 L=78 S=0x00 I=55569 F=0x0000 T=110 (#26) Feb 20 05:45:45 greatwall kernel: Packet log: input DENY ppp0 PROTO=17 211.228.134.118:137 12.82.128.114:137 L=78 S=0x00 I=55572 F=0x0000 T=110 (#26) Feb 20 05:45:45 greatwall kernel: Packet log: input DENY ppp0 PROTO=17 169.254.121.26:137 12.82.128.114:137 L=78 S=0x00 I=55573 F=0x0000 T=111 (#26) Feb 20 05:45:47 greatwall kernel: Packet log: input DENY ppp0 PROTO=17 169.254.121.26:137 12.82.128.114:137 L=78 S=0x00 I=55579 F=0x0000 T=111 (#26) Feb 20 05:45:47 greatwall kernel: Packet log: input DENY ppp0 PROTO=17 211.228.134.118:137 12.82.128.114:137 L=78 S=0x00 I=55580 F=0x0000 T=110 (#26) Feb 20 05:45:48 greatwall kernel: Packet log: input DENY ppp0 PROTO=17 169.254.121.26:137 12.82.128.114:137 L=78 S=0x00 I=55583 F=0x0000 T=111 (#26) Feb 20 05:45:48 greatwall kernel: Packet log: input DENY ppp0 PROTO=17 211.228.134.118:137 12.82.128.114:137 L=78 S=0x00 I=55584 F=0x0000 T=110 (#26) Feb 20 05:45:50 greatwall kernel: Packet log: input DENY ppp0 PROTO=17 211.228.134.118:137 12.82.128.114:137 L=78 S=0x00 I=55587 F=0x0000 T=110 (#26) Feb 20 05:45:50 greatwall kernel: Packet log: input DENY ppp0 PROTO=17 169.254.121.26:137 12.82.128.114:137 L=78 S=0x00 I=55588 F=0x0000 T=111 (#26) Feb 20 05:45:51 greatwall kernel: Packet log: input DENY ppp0 PROTO=17 169.254.121.26:137 12.82.128.114:137 L=78 S=0x00 I=55592 F=0x0000 T=111 (#26) Feb 20 05:45:51 greatwall kernel: Packet log: input DENY ppp0 PROTO=17 211.228.134.118:137 12.82.128.114:137 L=78 S=0x00 I=55593 F=0x0000 T=110 (#26) Feb 20 05:50:19 greatwall kernel: Packet log: input DENY ppp0 PROTO=17 169.254.121.26:137 12.82.128.114:137 L=78 S=0x00 I=56507 F=0x0000 T=111 (#26) Feb 20 05:50:19 greatwall kernel: Packet log: input DENY ppp0 PROTO=17 211.228.134.118:137 12.82.128.114:137 L=78 S=0x00 I=56508 F=0x0000 T=110 (#26) Feb 20 05:50:21 greatwall kernel: Packet log: input DENY ppp0 PROTO=17 211.228.134.118:137 12.82.128.114:137 L=78 S=0x00 I=56512 F=0x0000 T=110 (#26) Feb 20 05:50:21 greatwall kernel: Packet log: input DENY ppp0 PROTO=17 169.254.121.26:137 12.82.128.114:137 L=78 S=0x00 I=56513 F=0x0000 T=111 (#26) Feb 20 05:50:22 greatwall kernel: Packet log: input DENY ppp0 PROTO=17 169.254.121.26:137 12.82.128.114:137 L=78 S=0x00 I=56518 F=0x0000 T=111 (#26) Feb 20 05:50:22 greatwall kernel: Packet log: input DENY ppp0 PROTO=17 211.228.134.118:137 12.82.128.114:137 L=78 S=0x00 I=56519 F=0x0000 T=110 (#26) Feb 20 05:50:24 greatwall kernel: Packet log: input DENY ppp0 PROTO=17 169.254.121.26:137 12.82.128.114:137 L=78 S=0x00 I=56523 F=0x0000 T=111 (#26) Feb 20 05:50:24 greatwall kernel: Packet log: input DENY ppp0 PROTO=17 211.228.134.118:137 12.82.128.114:137 L=78 S=0x00 I=56524 F=0x0000 T=110 (#26) Feb 20 05:50:25 greatwall kernel: Packet log: input DENY ppp0 PROTO=17 211.228.134.118:137 12.82.128.114:137 L=78 S=0x00 I=56526 F=0x0000 T=110 (#26) Feb 20 05:50:25 greatwall kernel: Packet log: input DENY ppp0 PROTO=17 169.254.121.26:137 12.82.128.114:137 L=78 S=0x00 I=56527 F=0x0000 T=111 (#26) Feb 20 05:50:27 greatwall kernel: Packet log: input DENY ppp0 PROTO=17 169.254.121.26:137 12.82.128.114:137 L=78 S=0x00 I=56532 F=0x0000 T=111 (#26) Feb 20 05:50:27 greatwall kernel: Packet log: input DENY ppp0 PROTO=17 211.228.134.118:137 12.82.128.114:137 L=78 S=0x00 I=56533 F=0x0000 T=110 (#26)