Uh, If I am not mistaken, Port 139 is used for NetBios, hence you have computers lookng for a Netbios connection on your PC. I also run ZA on my WIN2K box, and I get this ALL the time from my other PC's on my LAN. As long as it's internal, and you recognize the IP, it's no biggie. It's when it's NON-LAN Ip's that you want to be careful, because some pc out there is trying to locate a share on your PC. ----- Original Message ----- From: "Kurt Hudson" To: Sent: Friday, April 12, 2002 2:34 PM Subject: Zone Alarm > This log shows that your local system has configured for an APIPA range > address 169.254.x.x and it is trying to communicate with 192.168.200.x > over port 139, which is the Microsoft end-point mapper. Read this CERT > article http://www.kb.cert.org/vuls/id/32650 > > ZoneAlarm Log text: > type,date,time,source,destination,transport > FWIN,2002/04/11,10:12:00 -7:00 > GMT,169.254.101.152:4335,192.168.200.xxx:139,TCP (flags:S) > FWIN,2002/04/11,10:13:55 -7:00 > GMT,169.254.101.152:4615,192.168.200.xxx:139,TCP (flags:S) > FWIN,2002/04/11,10:13:55 -7:00 > GMT,169.254.101.152:4618,192.168.200.xxx:139,TCP (flags:S) > FWIN,2002/04/11,10:13:55 -7:00 > GMT,169.254.101.152:4621,192.168.200.xxx:139,TCP (flags:S) > FWIN,2002/04/11,12:59:47 -7:00 > GMT,169.254.101.152:4995,192.168.200.xxx:139,TCP (flags:S) > FWIN,2002/04/11,12:59:47 -7:00 > GMT,169.254.101.152:4998,192.168.200.xxx:139,TCP (flags:S) > FWIN,2002/04/11,16:28:38 -7:00 > GMT,169.254.101.152:3626,192.168.200.xxx:139,TCP (flags:S) > FWIN,2002/04/11,16:28:38 -7:00 > GMT,169.254.101.152:3632,192.168.200.xxx:139,TCP (flags:S) > > As for tools that you can use to monitor such activities, visit: > > http://www.sysinternals.com for TCPView for your Windows boxes > > Look here for security tools > > http://www.cert.org/tech_tips/security_tools.html > http://216.60.197.200/Help/Sections/Security.htm > http://ciac.llnl.gov/ciac/ToolsUnixNetSec.html > http://razor.bindview.com/tools/index.shtml > > For a list of Security information that I have been able to compile, > visit http://www.hudlogic.com/tips.html (security) > > I haven't heard of Zone Alarm, so I obviously could use some more links > on that Security tips location. If you have suggestions, please send > them. > > Kurt Hudson > kurt@hudlogic.com > > ________________________________________________ > See http://PLUG.phoenix.az.us/navigator-mail.shtml if your mail doesn't post to the list quickly and you use Netscape to write mail. > > PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us > http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss