topic Question on Firewall Capture in Network Security

Question on Firewall Capture

kuldeep.kaur — Mon, 11 Mar 2019 20:04:32 GMT

Hi Guys,

I have capture some data on teh firewall so that I can troubleshoot the problem I am having. Here is the output from the firewall capture:

5: 13:07:45 .716775 802.1Q vlan#64 PO 10.150.254.80.137 > 10.150.254.127.137: udp 50

6: 13:07:45 .810048 802 1Q vlan#64 PO 10.150.254.80.137 > 10.150.254.127.137: udp 50

What does the above mean? Does it mean that source 10.150.254.80 is trying to talk to 10.150.254.127 on port 137 which is netbios? If yes than what is the meaning of port udp 50 ?

Or whether 10.150.254.80 is tyring to talk to 10.150.254.127 on port udp 50?

Any assistance will be really appreciated.

Tks

Re: Question on Firewall Capture

PAUL GILBERT ARIAS — Thu, 10 Mar 2011 22:58:03 GMT

10.150.254.80.137 > 10.150.254.127.137:

source ip 10.150.254.80 source port 137

destination ip 10.150.254.127 destination port 137

don't worry about the UDP 50.

I think that port is for netbios

Re: Question on Firewall Capture

Jennifer Halim — Thu, 10 Mar 2011 23:06:59 GMT

It means that source: 10.150.254.80, destination: 10.150.254.127, service: UDP/137 (Netbios), and and 50 is the size of the UDP packet (50 bytes).

Hope that answers your question.