All, I have seen some port scans, likely produced by nbtscan, which consists of a series of udp Netbios Name & Datagram requests on ports UDP 137/138 come in. The tool, nbtscan, is a handy way to detect all Windows machines that are on a particular sub-net. I would like to be able to detect it's use when someone scans my sub-nets. Is there a way to get RS 5.5 to detect this. Further, can I do it without substantial overhead. My sensors are lightly loaded and very responsive at the moment but I want to consider the cost/overhead that this type of detection might incur. I suspect that the RS engine would have to keep a table(for some seconds) of all IP addresses that sent in a UDP port connection and count the number of different IP addresses that it asked for. thanks Free, encrypted, secure Web-based email at www.hushmail.com
