SMB server seems to be probing the net for shares
mmcbride at bakerequipment.com
Wed Feb 21 16:29:43 GMT 2001
I happened to check the activity logs of my firewall and found that the
Samba server (our only linux box) is sending packets out to seemingly random
IP addresses on the 'net. They are all directed to port 53, and are being
blocked at the firewall, but they're firing off at a rate of 1 every 5-10
seconds. What gives? Have I been hacked, or is this normal or configurable
The box in question doesn't really run anything else and I'm the only one
with physical access to it.
Ideas or suggestions?
More information about the samba