Is this normal ISP behaviour?

Discussion in 'other firewalls' started by fannymites, Oct 10, 2005.

Thread Status:
Not open for further replies.
  1. fannymites

    fannymites Registered Member

    Joined:
    May 7, 2005
    Posts:
    93
    My Kerio logs are showing constant incoming connection attempts from my isp to ports 445 (every 1-2 minutes) and netbios ports (every 4-5 minutes).
    Is this normal? I've had no reason to inspect my logs for a while so I don't know if this is just recently or since I've been with them.
    Standalone computer, not connected to any others. Any services relating to remote/sharing etc are disabled and the ports are blocked by kerio so I'm not overly concerned at the moment, just curious.
     
  2. lotuseclat79

    lotuseclat79 Registered Member

    Joined:
    Jun 16, 2005
    Posts:
    5,094
    Hi fannymites,

    I too have noticed the same incoming hits on port 445 from my ISP. If the traffic is actually from our ISPs (I, too, with my firewall have the port blocked) then it is probably just beneign - annoying, but nothing to worry about.

    If, however, you google for ISP & "port 445" you might see some search hits that do not verify the traffic coming from the ISP. That's worrisome!

    -- Tom
     
  3. Paranoid2000

    Paranoid2000 Registered Member

    Joined:
    May 2, 2004
    Posts:
    2,839
    Location:
    North West, United Kingdom
    Yes, its normal - especially if you have a cable-based ISP which sets up its network like a large local network. Microsoft Windows by default sends out NetBIOS broadcasts so you are likely just seeing other people's systems which are not running a firewall.

    These may be probes also by the numerous worms out there using NetBIOS vulnerabilities to hijack systems, but this should be looked on as further justification for running a firewall at all times when online.
     
Loading...
Thread Status:
Not open for further replies.