Question on Firewall Capture

[kuldeep.kaur]

Hi Guys,

I have capture some data on teh firewall so that I can troubleshoot the problem I am having. Here is the output from the firewall capture:

5: 13:07:45 .716775 802.1Q vlan#64 PO 10.150.254.80.137 > 10.150.254.127.137:   udp 50

6: 13:07:45 .810048 802 1Q vlan#64 PO 10.150.254.80.137 > 10.150.254.127.137:   udp 50

What does the above mean? Does it mean that source 10.150.254.80 is trying to talk to 10.150.254.127 on port 137 which is netbios? If yes than what is the meaning of port udp 50 ?

Or whether 10.150.254.80 is tyring to talk to 10.150.254.127 on port udp 50?

Any assistance will be really appreciated.

Tks

[PAUL GILBERT ARIAS · Accepted solution]

10.150.254.80.137 > 10.150.254.127.137:

source ip 10.150.254.80 source port 137

destination ip 10.150.254.127 destination port 137

don't worry about the UDP 50.

I think that port is for netbios

[Jennifer Halim · Accepted solution]

It means that source: 10.150.254.80, destination: 10.150.254.127, service: UDP/137 (Netbios), and and 50 is the size of the UDP packet (50 bytes).

Hope that answers your question.