wrt54gc ?'s

03-09-2006, 18:59

Excuse if these seem dumb questions, just setup this router and at moment with just 1 pc connected, setup ok all working well, setup security page for router with all enabled, test via sygate/grc says all stealth.
I have software firewall and checking log notice many inbound blocked from router for port 137 (nbname).
I have netbios disabled.
Where are these coming from.
Tried googling but after reading many many pages cannot find anything realting to this.
Thanks for any enlightenment.

Graham M · 03-09-2006, 19:20

It'll be people "testing the water" to see if there are any vulerable ports open

pedantic · 03-09-2006, 19:31

Quote:

Originally Posted by Zeph

It'll be people "testing the water" to see if there are any vulerable ports open

If the OP's router is already set up to block and stealth the ports, the router will do just that, before anything reaches a software firewall. It sounds like it's just the router making an enquiry, to see what devices are attached. It won't be a scan from anyone from the outside world, nothing to worry about IMO.

03-09-2006, 19:40

Quote:

Originally Posted by pedantic

If the OP's router is already set up to block and stealth the ports, the router will do just that, before anything reaches a software firewall. It sounds like it's just the router making an enquiry, to see what devices are attached. It won't be a scan from anyone from the outside world, nothing to worry about IMO.

Thanks for the clarification, had sort of thought that but as a newbie to routers wanted to ensure that all was ok.

pedantic · 03-09-2006, 19:43

Quote:

Originally Posted by tony

Thanks for the clarification, had sort of thought that but as a newbie to routers wanted to ensure that all was ok.

Your software firewall log should tell you the souce ip address, where the intrusion is coming from. If the ip is the router's ip (192.168.1.1 for example) then I wouldn't worry too much.

03-09-2006, 20:09

Quote:

Originally Posted by pedantic

Your software firewall log should tell you the souce ip address, where the intrusion is coming from. If the ip is the router's ip (192.168.1.1 for example) then I wouldn't worry too much.

Yep it is coming from router ip, as it don't get past the software firewall it is no problem and anyway netbios is disabled, just like to know what is going on with this stuff, all adds to the learning process, or paranoia. lol.
Sorted.