SCAN: NBSTAT Query
This signature detects NBSTAT query packets directed to a netbios or samba server. The server will respond with a full enumeration of all known shares. This query technique is used by worms and attack tools to scan hosts prior to attack. These packets can also be sent by valid clients when connecting to a server.
Short Name
SCAN:AUDIT:NBSTAT-QUERY
Severity
Info
Recommended
False
Recommended Action
None
Category
SCAN
Keywords
NBSTAT Query
Release Date
01/09/2004
Supported Platforms
srx-branch-12.3
srx-19.3
srx-branch-19.3
vsrx3bsd-19.2
srx-branch-19.4
vsrx-19.4
mx-12.3
mx-19.4
vmx-19.4
mx-19.3
vsrx3bsd-19.4
srx-19.4
vsrx-12.3
vmx-19.3
vsrx-19.2
srx-12.3
Sigpack Version
3324
Port
UDP/137
False Positive
Occasionally