SMB server seems to be probing the net for shares

[Kenny]

Port 53 is used by named ... not Samba ... and Samba is probably trying to
do hostname lookups on internal IPs to root servers ("random" IPs) ...

Kenny 

/*
Meaning cannot be found in work or leisure but has to arise out of the
nature of the activity itself. 
*/

On Wed, 21 Feb 2001, Mark McBride wrote:

> 
> GGGGGEEEEEEEEEEEEZZZZZZZZZZ!!!!
> OK - port 53 - duh...
> 
> Please ignore my previous message.
> 
> Sorry. (it's not easy being me)
> -Mark
> 
> -----Original Message-----
> From: samba-admin at lists.samba.org [mailto:samba-admin at lists.samba.org]On
> Behalf Of Mark McBride
> Sent: Wednesday, February 21, 2001 11:30 AM
> To: samba at samba.org
> Subject: SMB server seems to be probing the net for shares
> 
> 
> 
> Hi,
>    I happened to check the activity logs of my firewall and found that the
> Samba server (our only linux box) is sending packets out to seemingly random
> IP addresses on the 'net.  They are all directed to port 53, and are being
> blocked at the firewall, but they're firing off at a rate of 1 every 5-10
> seconds.  What gives?  Have I been hacked, or is this normal or configurable
> behavior?
> The box in question doesn't really run anything else and I'm the only one
> with physical access to it.
> 
> Ideas or suggestions?
> 
> Thanks,
> Mark
> 
> 
> 
> 
> 
>