# Weird UDP connections



## Jopon (Sep 1, 2006)

Hey guys, guess i should introduce myself first since its my first time here. I'm Jopon. I found this fourm while i was looking around for a place to get this question answered 

So here goes. I just installed tiny person firewall. When i checked out the activity moniter, then the current connections, i noticed a section called 

System (NetBIOS)

Then under there subsections that look like this

TCP :1025
TCP: microsoft.ds (446)
TCP: netbios-ssn (139)
UDP: microsoft-ds (445)
UDP: netbios-dgm (138)
UDP: netbios-ns (137)


So i am looking at this and wondering what its all about when all of a sudden i see a connection made to upd netbios ns that looks like this.

UDP: netbios-ns (137)
>UDP: netbios-ns (137) -> 65.54.225.124: netbios-ns (137)

So as i am looking at this the connection closes. So i am a little weired out so i run a whois on the ip and it belongs to microsoft. So i keep watching and i see about 50 more of these connections made, all from various isps like verizon and shaw and stuff, and even a couple of connections made to UDP: netbios-dgm (138).

so i am just wondering if this is normal or what. I notice most of these ip's run a port scan before the connection is made. Once the connection is made they stay connected only long enough for my computer to transfer 246b of information out, and then it closes. Its the same every time. Whats going on here?


----------



## Cellus (Aug 31, 2006)

If you have a stand-alone system and do not personally use NetBIOS, you should turn it off as it exposes your system. If you do need NetBIOS (file and printer sharing, etc), remove it and instead install NetBEUI. NetBEUI, unlike plain NetBIOS, is non-routable and can not be accessed outside your network.


----------

