LinuxSA Mailing list archives

  From: Alan Kennington <akenning@dog.topology.org>
  To  : LinuxSA <linuxsa@linuxsa.org.au>
  Date: Mon, 17 Apr 2000 09:33:52 +091800

why netbios-ns?

Concerning UDP port 137....

Does anyone have an explanation for this:

=============================================================
==> /var/log/messages <==
Apr 17 08:42:00 dog kernel: IP fw-in deny ppp0 UDP 209.239.198.99:137 203.38.148.51:137 L=78 S=0x00 I=25361 F=0x0000 T=113
Apr 17 08:42:01 dog kernel: IP fw-in deny ppp0 UDP 209.239.198.99:137 203.38.148.51:137 L=78 S=0x00 I=25617 F=0x0000 T=113
Apr 17 08:42:03 dog kernel: IP fw-in deny ppp0 UDP 209.239.198.99:137 203.38.148.51:137 L=78 S=0x00 I=25873 F=0x0000 T=113

==> /usr/local/apache/logs/access_log <==
209-239-198-99.oak.jps.net - - [17/Apr/2000:08:42:06 +0930] "GET /under.html HTTP/1.1" 200 32583

==> /var/log/messages <==
Apr 17 08:42:08 dog kernel: IP fw-in deny ppp0 UDP 209.239.198.99:137 203.38.148.51:137 L=78 S=0x00 I=27921 F=0x0000 T=113

==> /usr/local/apache/logs/access_log <==
209-239-198-99.oak.jps.net - - [17/Apr/2000:08:42:08 +0930] "GET /akwww.jpg HTTP/1.1" 200 2470

==> /var/log/messages <==
Apr 17 08:42:09 dog kernel: IP fw-in deny ppp0 UDP 209.239.198.99:137 203.38.148.51:137 L=78 S=0x00 I=28945 F=0x0000 T=113
Apr 17 08:42:11 dog kernel: IP fw-in deny ppp0 UDP 209.239.198.99:137 203.38.148.51:137 L=78 S=0x00 I=30993 F=0x0000 T=113

==> /usr/local/apache/logs/access_log <==
209-239-198-99.oak.jps.net - - [17/Apr/2000:08:42:12 +0930] "GET /images/Bluelight.jpg HTTP/1.1" 200 4914
209-239-198-99.oak.jps.net - - [17/Apr/2000:08:42:16 +0930] "GET /images/gifs/for_adults.gif HTTP/1.1" 200 7141
209-239-198-99.oak.jps.net - - [17/Apr/2000:08:42:17 +0930] "GET /images/bvgraphics/jpg/uab-T-gb2.jpg HTTP/1.1" 200 4725 
==============================================================

This seems to happen a few times a day.
A browser accessing a web page sends out some UDP packets
to port 137 (netbios-ns).
But that's supposed to be a LAN protocol, isn't it?
(I don't know much about proprietary protocols.)

This kind of thing seems like what the MS mob would do to
"differentiate their product in the market place" -- i.e. to
undermine open standards.

Question 2:
Why do some browsers try to read the file "favicon.ico" in
the browsed directory and the / directory?
People keep on doing this to my web servers.
But when I try to read http://www.microsoft.com/favicon.ico
I get:

"Sorry, there is no microsoft.com Web page matching your request."

whereas if I try http://slashdot.org/favicon.ico, I get a rather
amusing result.

Once again, I think this is part of an "embrace and extend"
policy, i.e. "infiltrate and innovate".

Any clues on which brand of browser does these things?

Cheers,
Alan Kennington.

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++
PS.  In case you knew even less about PC power supplies
than me, one should never get one of these modern-fangled
ATX power supplies for computers that run linux and are
supposed to come back up after a power failure (such as we
are accustomed to in the third world [e.g. Adelaide]).
I bought a whiz-bang modern little unit, only to find that
I had to go back to an office personally to re-boot the machine
after a power break (24 hours after I installed on OS on it -
namely SuSE 6.2). Obviously I couldn't rely on being able to
log in to such a machine from overseas.
I reckon these ATX power supplies are clearly not intended for
use in servers.
 


-- 
LinuxSA WWW: http://www.linuxsa.org.au/  IRC: #linuxsa on irc.linux.org.au
To unsubscribe from the LinuxSA list:
  mail linuxsa-request@linuxsa.org.au with "unsubscribe" as the subject