[ILUG] AUTH requests on port 135.

[Jason Corcoran]

[COULD YOU CC ME TO ANY REPLIES : DNS problem on personal email and not 
registered on this account].

If have been running a smoothwall box connected to a cable modem service 
for about 1 and 1/2 months. I enabled snort on the box and periodically 
(two to three times a day) log in and look at the log files.

I have noticed a lot of MS-SQL worm attacks for certain ips and have 
blocked the reoccurring ones.

But one thing I see in my firewall logs are the following...
Time  	In  	Out  	Proto  	Source  Src 	Port  Destination  	Dst Port
10:05:37  	eth1  	-  	TCP  	66.236.199.35 4787 194.xxx.xx.xx 135

Port 135 is open on the smoothwall box by default, is it normal to get 
several (prob. about 2-300 a day) attempted connections on this port?
I have one server sitting in the DMZ should I have this port forwarded 
to a service on that machine or is there a service running by default on 
the smoothwall box?

Thanks
Jason.
-- 
________________________________________
Senior Software Engineer,
Activant Solutions Ltd.
Longford Ireland.

Email : Jason.Corcoran at Activant.com
Aim   : JasonCorcoran9
Http  : http://www.activant.com
Phone : + 353 (0) 43 49202