MonitorWare Knowledge Base

Why would the winsyslog computer connecting to my firewall on port 137?

When I run Winsyslog I see connections to my firewall from the winsyslog server every 4-5 seconds in the syslogs. Looking at the log on the firewall I see the connections much less frequent.

This goes away as soon as I stop winsyslog.

Why would this happen?

H.

It depends on your actions configured.
I can tell you for sure that WinSyslog does nothing without to be configured for it.

For example if you use a "net send" action somewhere, it could explain it.
Or you use DNS Name resolution and Windows tries to resolve names over netbios in background?

The only thing Winsyslog is configured for now is to save to file and interactive syslog.

Also, according the winsyslog it happenes every 4-5 seconds but i do not see the on the firewall itself. Almost look like Winsyslog is "messing up" and creating the entries.

I do not see everything I expect to see logged. I used to see more entries. This used to work fine with 4.2.

My firewall is a sonicwall with firmware 6.4.2.0 and I am running Winsyslog on the same network segment.

Maybe I should try to reinstall Winsyslog?

Heimir

NO, I see no reason to reinstall.
Have you checked if Resolve DNS names is enabled in WinSyslog Client or Interactive Syslog Server? If so please disabel it and try again.

Looks like that was the ticket.

Thanks.....

Heimir

Hi,

ok then it was what I thought. Windows tried DNS name resolution over netbios.