Netbios security Issue?

Discussion in 'other firewalls' started by daniel952, Feb 22, 2011.

Thread Status:
Not open for further replies.
  1. daniel952

    daniel952 Registered Member

    Joined:
    Jul 30, 2004
    Posts:
    71
    I am using Firefox to browse. and it seems to lose its connection with every other link that I click. Each lost connection shows the following in my firewall logs:

    Protocol: UDP Out
    IP 192.168.0.8:137 > 192.168.0.255:137

    It looks like my local IP is sending packets to the router's broadcast address using Netbios. I have always had netbios port disabled in my firewall

    My questions are:

    1. Why would UDP port 137/Netbios suddenly need to send to the router broadcast IP?

    2. The packets appear to be dropped, so should I allow IP 192.168.0.8:137 > 192.168.0.255:137 to fix my browsing issues, or could there be something sinister going on?

    With netbios disabled in WINS, and UDP port 137 blocked, I have not had issues with lost connections until yesterday. I am looking for help, because I haven't been able to figure this problem out.
     
    Last edited: Feb 22, 2011
  2. Heimdall

    Heimdall Registered Member

    Joined:
    Jul 29, 2009
    Posts:
    176
    I'm not really sure I can see how the two events are connected.

    NetBIOS over UDP on port 137 is simply a name broadcast, that is, a NetBIOS enabled device on your network (PC) is letting other devices on the same network, know of it's existence. It's actually refereed to as the Name Registration Service. If you've disabled NetBIOS on the network adapter, it shouldn't be still broadcasting.

    Depending on which version of firefox you're using, there have been a number of reported issues with the browser 'timing out' and 'dropping' connections.

    Do you have any additional details, log files etc?
     
  3. daniel952

    daniel952 Registered Member

    Joined:
    Jul 30, 2004
    Posts:
    71
    There does seem to be a connection due to the timing of the firewall entry and the lost connections. They happen concurrently in every instance of the problem occurring.
    I recently reset my TCPIP using the command prompt. Maybe there is some sort of conflict between the network adapter, and a blocked UDP port 137 in my firewall. I will check to make sure that netbios was not affected by the TCPIP reset, and is still off in TCPIP properties of my network adapter.
     
  4. Heimdall

    Heimdall Registered Member

    Joined:
    Jul 29, 2009
    Posts:
    176
    If you used 'netsh int ip reset' it will set the NetBIOS options for each interface.
     
  5. daniel952

    daniel952 Registered Member

    Joined:
    Jul 30, 2004
    Posts:
    71
    Thats exactly the command that I used. Thanks
     
Loading...
Thread Status:
Not open for further replies.