Perhaps this will help: Per Microsoft: Prt Pro Service Alias Description 135 TCP epmap loc-srv DCE endpoint resolution 135 UDP epmap loc-srv DCE endpoint resolution 137 TCP netbios-ns nbname NETBIOS Name Service 137 UDP netbios-ns nbname NETBIOS Name Service 138 UDP netbios-dgm nbdatagram NETBIOS Datagram Service 139 TCP netbios-ssn nbsession NETBIOS Session Service 445 TCP Microsoft CIFS 445 UDP Microsoft CIFS
Note that in NT 4.0, port 134/TCP was sometimes used for DNS/WINS per Microsoft. IIRC, port 135 is the RPC/DCE/[D]COM lookup/mapper. This is similar to rpcbind/portmap on UNIX. I believe some file share features use this port. That is not to say that you can't get away with blocking it, you'll have to try it out. 137-139 are the NetBIOS ports as described above. Actually they are used for other things that aren't describe above, but it's a good start. I believe port 445 is new to 2000/XP. The idea with this port is to do file sharing without NetBIOS. IIRC, if you disable NetBIOS in 2000/XP, it uses this port for file sharing. I believe Samba at least uses 137-139 and 445, but I'm not sure if it uses 135. In any case, you should not need port 136 open. Hope this helps, <> Jim -----Original Message----- ok, but why 135, and 136? also if i don't use winy2k then would i still need 445 open for files sharing? (because i'm using XP) > --david weise >i use ports from 135-139 and port 445 tcp/udp to get >samba working with ipfilter. > > > -----Ursprungliche Nachricht----- > > i've filtered port 137,138 and 139 on ipfilter so that my > > server can use > > samba. i'm getting complaints that the performance has hit rock bottom. > > when i remove the rules everything goes back to normal. am i missing > > something? or can i tweek ipfilter better?
