topic Netbios 137/138 through ASA- UDP request discard logs in Network Security

Netbios 137/138 through ASA- UDP request discard logs

Ramesh M — Tue, 12 Mar 2019 03:14:27 GMT

Hi,

I am getting lot of UDP request discarded from 10.145.0.66/138 to outside 10.145.0.255/138(Log message ID 710005).

I herewith attaching the config file.

Appreciate your early response.

Regards / Ramesh M

Netbios 137/138 through ASA- UDP request discard logs

Jouni Forss — Sat, 07 Dec 2013 11:57:44 GMT

Hi,

As with your other discussion, this seems to be broadcast traffic related to Netbios that stops at the firewall as expected.

- Jouni

Re: Netbios 137/138 through ASA- UDP request discard logs

Ramesh M — Sat, 07 Dec 2013 13:33:02 GMT

From where the traffic initiated/ reason for this error. Why this netbios traffic to be broadcat.

Also the source and destinations are in the same interface.

Please siggest

Regards / Ramesh M

Netbios 137/138 through ASA- UDP request discard logs

Jouni Forss — Sat, 07 Dec 2013 13:48:24 GMT

Hi,

The traffic is initiated from the host mentioned in the log message (10.145.0.66) and the broadcast is naturally destined for the broadcast address (10.145.0.255) of that subnet as you can see from the log message also. The source and destination are naturally on the same network as broadcast traffic wont go beyond the first L3 hop (router hop) in the network.

I dont know the operation of Netbios enough to give you a good explanation but to my understanding in Windows host networks if no separate name server is used the operation is based on broadcast traffic.

In your case the ASA naturally sees this traffic as its broadcast traffic and drops it as expected.

- Jouni

Netbios 137/138 through ASA- UDP request discard logs

Ramesh M — Sat, 07 Dec 2013 16:12:33 GMT

Still I am gettng huge number of discard traffic,

Is any chance of port scanning/ attack/ botnet

Netbios 137/138 through ASA- UDP request discard logs

Jouni Forss — Sat, 07 Dec 2013 16:15:25 GMT

Hi,

If you have your Windows host on a switch network and their gateway is the ASA then you will keep seeing these messages from multiple devices.

These messages are not port scanning. They are just typical broadcast traffic from the Windows hosts.

- Jouni

Netbios 137/138 through ASA- UDP request discard logs

Ramesh M — Sun, 08 Dec 2013 08:36:22 GMT

Hi,

Is it possible to disable the netbios port 137 and 138 on server. will it cause any impact.

Please suggest.

Regards / Ramesh M

Netbios 137/138 through ASA- UDP request discard logs

Julio Carvajal — Sun, 08 Dec 2013 20:06:53 GMT

Hello,

Are you using DHCP on your network?

You can do this via DHCP.

Or manually

From the Start menu, right-click My Computer, and then click Manage.
Expand System Tools, and then clear the Device Manager check box.
Right-click Device Manager, point to View, and then select Show hidden devices.
Expand Non-Plug and Play Drivers.
Right-click NetBios over TCP/IP, and then click Disable.

This disables the SMB direct host listener on

Rate all of the helpful posts!!!

Regards,

Jcarvaja

Follow me on http://laguiadelnetworking.com