Is this normal ISP behaviour?

My Kerio logs are showing constant incoming connection attempts from my isp to ports 445 (every 1-2 minutes) and netbios ports (every 4-5 minutes).
Is this normal? I've had no reason to inspect my logs for a while so I don't know if this is just recently or since I've been with them.
Standalone computer, not connected to any others. Any services relating to remote/sharing etc are disabled and the ports are blocked by kerio so I'm not overly concerned at the moment, just curious.

 

Hi fannymites,

I too have noticed the same incoming hits on port 445 from my ISP. If the traffic is actually from our ISPs (I, too, with my firewall have the port blocked) then it is probably just beneign - annoying, but nothing to worry about.

If, however, you google for ISP & "port 445" you might see some search hits that do not verify the traffic coming from the ISP. That's worrisome!

-- Tom

 

Yes, its normal - especially if you have a cable-based ISP which sets up its network like a large local network. Microsoft Windows by default sends out NetBIOS broadcasts so you are likely just seeing other people's systems which are not running a firewall.

These may be probes also by the numerous worms out there using NetBIOS vulnerabilities to hijack systems, but this should be looked on as further justification for running a firewall at all times when online.