# Why am I suddenly getting so many NetBIOS Name alerts?

**URL:** <https://boards.straightdope.com/t/why-am-i-suddenly-getting-so-many-netbios-name-alerts/133300>\
**Category:** Factual Questions\
**Created:** [October 21, 2002, 11:02pm UTC](https://boards.straightdope.com/t/why-am-i-suddenly-getting-so-many-netbios-name-alerts/133300 "2002-10-21T23:02:05Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bob\_Scene](https://avatars.discourse-cdn.com/v4/letter/b/e19adc/32.png) [@Bob\_Scene](https://boards.straightdope.com/u/Bob_Scene)\
**Post date:** [October 21, 2002, 11:02pm UTC](https://boards.straightdope.com/t/why-am-i-suddenly-getting-so-many-netbios-name-alerts/133300/1 "2002-10-21T23:02:05Z")

</div>

All of a sudden I’m getting these:

> [@](#):
>
> The firewall has blocked Internet access to your computer (NetBIOS Name) from xx.xx.xx.xx (UDP Port 1025).

from Zone Alarm an average of once every six minutes, all from different IP addresses, and aimed at various ports. In the past I hardly ever saw these.

What is the purpose of sending requests like these? Why are there so many of them all of a sudden? If this is someone trying to break into my computer, is Zone Alarm enough to keep them out?

---

<div class="post-metadata">

**Author:** ![Una\_Persson](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/una_persson/32/346_2.png) [@Una\_Persson](https://boards.straightdope.com/u/Una_Persson)\
**Post date:** [October 22, 2002, 1:39am UTC](https://boards.straightdope.com/t/why-am-i-suddenly-getting-so-many-netbios-name-alerts/133300/2 "2002-10-22T01:39:46Z")

</div>

Try this link:

[http://www.robertgraham.com/pubs/firewall-seen.html](http://www.robertgraham.com/pubs/firewall-seen.html)

By a quick glance, it does not mention the exact, specific problem that you are having, but it has some other good info that may help you nonetheless.

---

<div class="post-metadata">

**Author:** ![Urban\_Ranger](https://avatars.discourse-cdn.com/v4/letter/u/e9c0ed/32.png) [@Urban\_Ranger](https://boards.straightdope.com/u/Urban_Ranger)\
**Post date:** [October 22, 2002, 12:06pm UTC](https://boards.straightdope.com/t/why-am-i-suddenly-getting-so-many-netbios-name-alerts/133300/3 "2002-10-22T12:06:47Z")

</div>

Looks like some ankle biters are trying a broad spectrum to see which machines they can break-in.

---

<div class="post-metadata">

**Author:** ![Urban\_Ranger](https://avatars.discourse-cdn.com/v4/letter/u/e9c0ed/32.png) [@Urban\_Ranger](https://boards.straightdope.com/u/Urban_Ranger)\
**Post date:** [October 22, 2002, 12:08pm UTC](https://boards.straightdope.com/t/why-am-i-suddenly-getting-so-many-netbios-name-alerts/133300/4 "2002-10-22T12:08:21Z")

</div>

Make that “broad spectrum scan”

---

<div class="post-metadata">

**Author:** ![Eleusis](https://avatars.discourse-cdn.com/v4/letter/e/f4b2a3/32.png) [@Eleusis](https://boards.straightdope.com/u/Eleusis)\
**Post date:** [October 22, 2002, 12:19pm UTC](https://boards.straightdope.com/t/why-am-i-suddenly-getting-so-many-netbios-name-alerts/133300/5 "2002-10-22T12:19:20Z")

</div>

It’s likely that script kiddies are scanning massive blocks of IPs looking for security holes as Urban Ranger points out, but you could also have a trojan horse sending out the “I’m here” signal.

I highly recommend [Swat It](http://www.lockdowncorp.com/bots/downloadswatit.html) to scan your machine for Trojans. It does a much better job of this than Ad Aware or traditional virus programs like Norton and McAfee.