Re: Help.. Unwanted network traffic - netbios-ssn port 139

From: Phillip Windell (_at_.)
Date: 01/26/05 

Date: Wed, 26 Jan 2005 14:51:54 -0600

"Thousands" really isn't that much. Since things are measured in
Milliseconds, at a rate of once single occurance per millisecond, you can
have a "thousand" things happen in one second. This is usually normal
traffic. Half of Ethernet traffic is this kind of stuff, and on an "idle"
network almost 100% of the traffic is this kind of stuff. You have to
actually examine the details of the packets to see what is really
happening,...simply the fact that they exist doesn't make it a problem.

Most modern Virus/Worms are TCP/IP based not "netbios". I'm not saying you
still couldn't have a problem or that it can't be a Virus/Worm,...I'm just
trying to give it some perspective. 

-- 
Phillip Windell [MCP, MVP, CCNA]
www.wandtv.com
"Manthien" <thienvc@hotmail.com> wrote in message
news:F8A5EACB-2678-4F86-9863-2F0FACA291C0@microsoft.com...
> I sniff my network and found that thousands of netbios-ssn traffic
> generated by client workstation (W2k Pro). These traffics were desinated
to
> random network segment through port 139 and it causes heavy
> network traffics.  Kindly advise how to stop these traffics. Thanks
>
>
> -- 
> From Manthien
> thienvc@hotmail.com

Relevant Pages

  • Re: Statistical Anomaly Analysis?
    ... If you set up your model to account for each event type as a part of the ... the aggregation of traffics should smooth the ... > key, events that were 6-sigma outliers for a small network, and hence ... > likewise has an immense amount of variability; but its bulk statistics ...
    (Focus-IDS)
  • Re: Statistical Anomaly Analysis?
    ... the aggregation of traffics should smooth the ... > out of a lot of other signals ... key, events that were 6-sigma outliers for a small network, and hence ... likewise has an immense amount of variability; but its bulk statistics ...
    (Focus-IDS)
  • Re: Statistical Anomaly Analysis?
    ... > traffics or the total amounts of network traffics. ... > the recent short term distribution should be close to the long term ... of anomaly detection is typically vulnerable to data set poisoning. ...
    (Focus-IDS)
  • RE: Statistical Anomaly Analysis?
    ... define statistical concepts of network normalcy. ... > traffics or the total amounts of network traffics. ... of anomaly detection is typically vulnerable to data set poisoning. ... if you are getting statistics about a users login habits over ...
    (Focus-IDS)
Loading