SMTP and NETBIOS

[jmaestrale]

Does anyone know why a connection is built for netbios port 137 to the mail server when mail comes in the network from the outside.

mail--->router--->pix---->internet--->mailclient

[dtodd]

If your firewall is blocking all inbound connectivity to port 137-139 then you should not see this inbound. If you are then you should evaluate your firewall rule set to find a hole.

If the connection is inbound-outbound then the server has made a request for a name lookup using gethostbyaddr(). 137 is used by microsoft and wins type lookups.

[jmaestrale]

Thanks,

It is an inbound-->outbound communication. How do I stop It?

[rrbleeker]

You can stop it by changing the settings on the mail server (WINS server) or by implementing an access control list on the inside interface.