topic Re: UDP Port Scan in Network Security

UDP Port Scan

dukeminus — Mon, 11 Mar 2019 17:40:55 GMT

I keep getting the following message in my logs and I am trying to find out

how I can resolve this. Thanks in advance for all of your help.

- No UDP Server to service request

- request discarded to service: 137

- source machine - 10.20.5.6

- destination machine - 10.20.255.255

source port = 137

destination port = 137

This is taking place on the inside interface.

Re: UDP Port Scan

Federico Coto Fajardo — Tue, 04 May 2010 14:59:35 GMT

Hi,

Find out why the source machine 10.20.5.6 is sending NetBIOS traffic in your LAN.

NetBIOS uses broadcast communication on those ports.

Federico.

Re: UDP Port Scan

astripat — Tue, 04 May 2010 15:02:52 GMT

Hi,

I hope you are getting the following syslog:

710005

Error Message    %PIX|ASA-7-710005: {TCP|UDP} request discarded from 
source_address/source_port to interface_name:dest_address/service

Explanation This message appears when the security appliance does not have a UDP server that services the UDP request. The message can also indicate a TCP packet that does not belong to any session on the security appliance. In addition, this message appears (with the service snmp) when the security appliance receives an SNMP request with an empty payload, even if it is from an authorized host. When the service is snmp, this message occurs a maximum of 1 time every 10 seconds so that the log receiver is not overwhelmed.

The decription can be found here:

http://www.cisco.com/en/US/docs/security/asa/asa72/system/message/logmsgs.html

when exatly you get this syslog?

HTH

Ashu