Look 'n' Stop Port 137 Connections?

Discussion in 'LnS English Forum' started by 0strodamus, Jul 25, 2010.

Thread Status:
Not open for further replies.
  1. 0strodamus

    0strodamus Registered Member

    Joined:
    Aug 23, 2009
    Posts:
    1,047
    Location:
    United Surveillance States
    I'm trying Look 'n' Stop 2.0.7 in a VM and am finding that it is trying to make connections to several addresses on port 137. The first addresses that it hit were to OpenDNS, which I use for my DNS through a localhost DNS proxy. The rest of the addresses I don't recognize (except the last one which is Google). I'm seeing these connection attempts in Malware Defender and the logs from MD are below. Does anyone know why these connections are being made? Does LnS try a connection attempt on port 137 if a DNS lookup fails? I set LnS to log my HTTP rule and the connection attempts are made for all addresses that LnS fails to resolve. Is this normal?

    The weird thing is that if I allow these connections with MD and set the Stop NetBIOS rule in LnS to log, it does log the connections as blocked.

    Code:
    7/25/2010 18:11:05    Access network    Denied
    Process: c:\program files\looknstop\looknstop.exe
    Target: UDP [Local host : 137 (netbios-ns)] ->  [208.67.222.222 : 137 (netbios-ns)]
    Rule: [Network]Any protocol [Local host : Any port] <-> [Any address : Any port]
    
    7/25/2010 18:11:18    Access network    Denied
    Process: c:\program files\looknstop\looknstop.exe
    Target: UDP [Local host : 137 (netbios-ns)] ->  [208.67.220.220 : 137 (netbios-ns)]
    Rule: [Network]Any protocol [Local host : Any port] <-> [Any address : Any port]
    
    7/25/2010 18:23:20    Access network    Denied
    Process: c:\program files\looknstop\looknstop.exe
    Target: UDP [Local host : 137 (netbios-ns)] ->  [8.10.179.164 : 137 (netbios-ns)]
    Rule: [Network]Any protocol [Local host : Any port] <-> [Any address : Any port]
    
    7/25/2010 18:24:19    Access network    Denied
    Process: c:\program files\looknstop\looknstop.exe
    Target: UDP [Local host : 137 (netbios-ns)] ->  [8.10.179.165 : 137 (netbios-ns)]
    Rule: [Network]Any protocol [Local host : Any port] <-> [Any address : Any port]
    
    7/25/2010 18:24:59    Access network    Denied
    Process: c:\program files\looknstop\looknstop.exe
    Target: UDP [Local host : 137 (netbios-ns)] ->  [8.10.179.160 : 137 (netbios-ns)]
    Rule: [Network]Any protocol [Local host : Any port] <-> [Any address : Any port]
    
    7/25/2010 18:45:57    Access network    Denied
    Process: c:\program files\looknstop\looknstop.exe
    Target: UDP [Local host : 137 (netbios-ns)] ->  [74.125.11.21 : 137 (netbios-ns)]
    Rule: [Network]Any protocol [Local host : Any port] <-> [Any address : Any port]
    
    
    EDIT: I'm seeing the same thing using CyberKit to do DNS lookups, so I'm thinking this is normal behavior.
     
    Last edited: Jul 25, 2010
  2. Phant0m

    Phant0m Registered Member

    Joined:
    Jun 7, 2003
    Posts:
    3,684
    Location:
    Canada
    This is normal when an application does DNS lookups.
     
  3. 0strodamus

    0strodamus Registered Member

    Joined:
    Aug 23, 2009
    Posts:
    1,047
    Location:
    United Surveillance States
    Thanks for the confirmation Phant0m!
     
Thread Status:
Not open for further replies.