NETBIOS-SSN Weird sessions

  • Thread starter Thread starter Olivier DALOY
  • Start date Start date
O

Olivier DALOY

Dear all,

I've been detecting NETBIOS-SSN sessions between my laptop
and many others from my company, and wonder why these
connection take place since :
- I'm not opening the network neighbourhood wizard, nor
trying to access other computers' shares
- The connection last for less than a minute, and they are
inactive for the connection time minus 3 seconds
- No file is opened on the remote (target ?) machine

Is this symptomatic of a virus or worm on my laptop ?

Thanks for your help and best regards,

Olivier
 
Not necessarily as that would not be unusual particularly for traffic to domain
controllers. A packet sniffer like Ethereal would give more detailed information on
these sessions. Mapped drives can also cause a lot of this activity as can browse
list activity which does not require you to access MY Network Places. Make sure you
do a virus scan at least weekly with updated definitions. Generally a worm on your
computer would generate tons of activity on the network often involving a lot of
pinging and possibly generating failed logon attempts on other network computers for
the administrator account. --- Steve
 
Back
Top