[dreilly1]

Does anyone know why my 10.2-upgraded Macs are spweing stuff out of Port 137? Is this Rendesvous or something? (/etc/services on Linux says its a NetBios Name Server port...)

It triggered my Linux-based firewall, and put the two computers' internal IP addresses into my block list, which wasn't very nice.

What's scary is that, according to my packet logs, it seems like these Macs were trying to send broadcast packets on Port 137 to other IP addresses! The firewall squished these, but I'm seeing lots more external traffic trying to connect on port 137 now, which is troubling. Maybe one or two got out...

Well, I've squashed all incoming traffic specifically on 137, so that's not an issue anymore. But I'd like to know what these Macs were doing, and whether I should be concerned....

Thanks!

[Camelot]

Have you turned on Windows File Sharing? or some other Windows-networking product (e.g. DAVE)?

Under normal circumstances I wouldn't expect to see any port 137 traffic coming from a Mac unless it was participating in a Windows network environment.

[dreilly1]

Well, I don't do windows, and I'm not running any Windows file sharing or anything. I'm blissfully ignorant about how Windows shares files, as you could probably tell from my last post.

I wonder whether searching for a server to connect to (via the Connect to Server dialog) would trigger this?

[superfoo]

TCP and UDP ports 137 - 139 are all for netbios services (a/k/a windows file / print sharing.)

If you have SMB enabled on your mac, it is probably sending broadcast packets to find other SMB hosts on your LAN.

You could try disabling SMB in the Directory Access applet... I have not tried this myself, as I do use SMB for file/print sharing, but most likely, this will fix your problem.

[dreilly1]

I am sharing a printer via my network, although not to Windows machines. After work I'll have to check to see if printing sends packets out on Port 137, and check out that Directory Access applet.

I checked last night, and while the "Connect to server" window is "searching" it does send out broadcast packets on 137, broadcasting to the network that the computer is currently on. However, it doesn't explain the broadcast packets to other networks that are in my logs.

I'm beginning to think that someone managed to spoof packets with my (non-obvious) internal IP addresses through my Linux firewall (which should have filtered these out...) This isn't a Mac problem at all, of course. But if my Macs are broadcasting on 137 even if "windowd file sharing" is turned off, I'd still like to put a stop to it...