System UDPing to self . . .

[NativeTexan]

My system is within my Signature, CIS is showing many UDPs sent from IP 192.168.1.64:137 to 192.168.1.225:137 and I do not allow any UDP or IGMP. I have one from "122.227.164.96 is traced to:Ningbo, China" (traced by IPILLIONdotCOM) just from today, that is not all of them either.

Any ideas?

Edited August 20, 2009 by NativeTexan

[cluberti]

Well, it looks like 192.168.1.64 is trying to request netbios info from 192.168.1.225. Since I don't know what machines are at what IP I cannot say for sure why, but it's fairly innocuous if you own both machines.

[Mr Snrub]

UDP port 137 is used by NetBIOS Name Service.

(In addition to UDP 137 you often see UDP 138, TCP 139 and TCP 445 - the latter being "NetBIOS over TCP/IP", also the primary port for SMB traffic.)

You sure it was 192.168.1.225 and not 192.168.1.255?

The first would be a unicast (packet sent explicitly to one machine), the second would be a broadcast (client "yelling" to everyone in the subnet, the old method of network discovery).

[NativeTexan]

UDP port 137 is used by NetBIOS Name Service.

(In addition to UDP 137 you often see UDP 138, TCP 139 and TCP 445 - the latter being "NetBIOS over TCP/IP", also the primary port for SMB traffic.)

You sure it was 192.168.1.225 and not 192.168.1.255?

The first would be a unicast (packet sent explicitly to one machine), the second would be a broadcast (client "yelling" to everyone in the subnet, the old method of network discovery).

'Mr Snrub,'

You are correct about that being "*.*.*.255", it seems I get my numbers transposed or totally wrong.

Thank you for the reply and excuse me for being so long in getting back to this thread. Have had other problems on my system that are yet to be resolved or any one responding with information. That is in another thread.

'Cluberti,'

Well it is not 'both' machines, it is only one computer and it is mine. There are not any other on this connection.

Thank you to you both for these replies and the info,