myNetWatchman   KnowledgeBase

Pooling knowledge to
secure the internet.


mNW Reports  FAQ: mNW Reports




(Registered Users Only)


Look Up Incidents by IP Address
 

 

Created: 07-May-2001
Modified: 07-May-2001
By: Lawrence Baldwin

Likely target acquistion for SAMBA Swat (web configuration tool).

From: mNW Agent 'proalias':

Port 901 is the Samba Swat port.

Samba is the program (see www.samba.org) which allows network communication between Unix and Windows boxes using the smb [Server Message Block] protocol (port 139). Swat is the web configuration tool for Samba. One normally restricts access to this port to designated terminal(s) from within the LAN, although some admins may play the risky game of allowing access from the internet. Most likely the perpetrator is someone playing around with their PC, likely to get an unpleasant surprise from their ISP. regards.