SMB server seems to be probing the net for shares
kenny at hereintown.net
Wed Feb 21 17:33:31 GMT 2001
Port 53 is used by named ... not Samba ... and Samba is probably trying to
do hostname lookups on internal IPs to root servers ("random" IPs) ...
Meaning cannot be found in work or leisure but has to arise out of the
nature of the activity itself.
On Wed, 21 Feb 2001, Mark McBride wrote:
> OK - port 53 - duh...
> Please ignore my previous message.
> Sorry. (it's not easy being me)
> -----Original Message-----
> From: samba-admin at lists.samba.org [mailto:samba-admin at lists.samba.org]On
> Behalf Of Mark McBride
> Sent: Wednesday, February 21, 2001 11:30 AM
> To: samba at samba.org
> Subject: SMB server seems to be probing the net for shares
> I happened to check the activity logs of my firewall and found that the
> Samba server (our only linux box) is sending packets out to seemingly random
> IP addresses on the 'net. They are all directed to port 53, and are being
> blocked at the firewall, but they're firing off at a rate of 1 every 5-10
> seconds. What gives? Have I been hacked, or is this normal or configurable
> The box in question doesn't really run anything else and I'm the only one
> with physical access to it.
> Ideas or suggestions?
More information about the samba