repeate attackers on network

diroga

diroga

New Member
the college network is a battle ground. my fire wall keeps blicking activity form the same group of IP addresses. my addrress is x.x.x.234 the guy next to me in the form is x.x.x.205. the address are the same x.x.x. they are :195, 200, 215, 246, 243, 207, 248 242, 222. they are using UDP ports 137 and 138. so i am guessing that it is coming from the same dorm. there are about 50 addresses for this form. I keep loosing my internet connection while my roommate who has a mac doesnt loose connection. i dont know if my lack of interent is hardware/software or malicious activitiy. your insight is welcomed.
 
what firewall is that you are using btw?
If your wall is set up tight with few exceptions then you should be fine, it does seem to be catching them.
How are you connecting to the web, your loss of connection maybe driver/firmware related.

Since this is a college dorm, you should note the ip addresses causing the issues and speak to the network admin guys. they may be able to track the mac addy of that machine and block it, causing the culprit to reveal himself.

but first do read
http://www.dshield.org/ports/port137.php
 
Last edited:
The "attacks" may not even be that..

Windows uses it's own system to translate IP addresses into Windows names. These windows names are usually used to identify PCs participating in windows file sharing. However, Windows will attempt to obtain the "windows name" of every other computer it connects to.As a result, Windows has the habit of "probing" port 137.


Port 138-
This is the second port of the original "NetBIOS trio" used by the first Windows operating systems (up through Windows NT) in support of file sharing.

Basically these machines are asking your machine for its name, and then checking to see if file sharing is available. MAKE SURE FILE SHARING IS COMPLETELY OFF! people can log into your pc with remote connection //computername\c$ if you do not have a password assigned to your admin account... I would not worry about these ports (137, 138).. but check that no folders are shared.. Viruses spread quick at college..(on the computer aswell)
 
Last edited:
I dont understand where to go to turn it off.

I am using nVidea's fire wall that came wiht the motherboard.

it turns out that the whole college network had a hardware problem. but still i am wondering about the same IP addresses showing up. more than likely it is just "harmless" P2P software looking for music?
 
well not p2p someone could have clicked the netowrk places, and opened your workgroup.. which requires your computer to tell them the name of your pc.. If you want you can go see what everyone else is sharing aswell. click my network places... veiw workgroup computers, (there are now two little tabs on the left side of the window, the bottom one says "microsoft windows network"... All those things listed are workgroups setup by people. the default is workgroup. clcik on workgroup and start browsing what people have shared... Each individual icon is another computer. Have fun, make sure you have antivirus... and dont get any .exe files ;)
 
diroga said:
i clicked on my network places and could not see any of the things you said. i am using w2kpro.
Click to expand...


:rolleyes: Win2k.. You do need to enable file and print sharing to be able to file and printer view... You can have all your folder unshared, but still view their stuff... Try to enable it..
 
You must log in or register to reply here.
Back
Top