The IP space 169.254.x.x is reserved address space for machines doing DHCP requests
and not getting a response. It is implemented in later versions of MS Win/x and other
operating systems. You should not allow this space to route from your network (like
the other RFC 1918 private spaces, 10.0.0.0/8, 172.16.0.0/24 and 192.168.16.0/28). I
would guess the destination address was 169.254.x.255 which would mean you machine was
trying to get WINS parameters from what it thinks is a WINS broadcast address. The
source port is in the correct ephemeral port range for a Win2K machine.
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Scott Holmes
Sent: Thursday, March 08, 2001 13:31
To: [EMAIL PROTECTED]
Subject: Outbound attemps, port 61000 -> 137 ?
I spotted some denied outbound attempts from my firewall's external IP
to a 169.254.X.X address. The source port was 61000 and the destination
was 137. 61000 is IP Masqurading and 137 is NetBios right? I was not
trying to access a netbios share over the net, what's going on?
-
[To unsubscribe, send mail to [EMAIL PROTECTED] with
"unsubscribe firewalls" in the body of the message.]
-
[To unsubscribe, send mail to [EMAIL PROTECTED] with
"unsubscribe firewalls" in the body of the message.]
