icmp on port 138

[Peter Brimacombe]

on HP-UX 10.20
my network guy says my C100 workstation is sending out icmp packets for port 138

how do I turn it off?

I have taken port 138 out of /etc/services and have rebooted the workstation but it is still sending out icmp packets (broadcasting I think)

where can I look?

[Dirk Wiedemann]

Hello,

ICMP pakets on Port 138 are possibly send to discover the default gateway of a network segment if no default gateway is manual configured or assigned by DHCP.
So: if your workstation has a static IP (not a DHCP client), check your /etc/hosts file for a default gateway. And if your Workstation is a DHCP-client tell your network gui to configure the assignment of a default gateway.
Hope this helps
Dirk

[Peter Brimacombe]

there was an entry in /etc/hosts had "router" instead of "gateway"

I changed it to router but it is still broadcasting this icmp packets!

thanks to Dirk anyway

[Ron Kinner]

Do you have SAMBA running? Port 138 is NETBIOS Datagram Service and broadcasts to port 138 are used to fill out the Network Neighborhood table.

Ron

[Peter Brimacombe]

No I don't have Samba running but two years ago I ran a Samba-like product called VisionFS. I deleted it I thought. netstat -an | grep 138 shows nothing.

any ideas?

[T G Manikandan]

The NetBIOS name service and datagram service broadcast name query requests to all NetBIOS applications

NetBIOS Datagram service provides connectionless and broadcast-oriented communications, making use of the UDP port number 138

Any application uses broadcasts for making communications.

This could be samba,omniback,anything.
any Openview application,

Just download lsof and check the processes using that port.

YOu can start by finding whether the 138 icmp broadcasts are there all the time or some specific time

[Peter Brimacombe]

problem solved!

on a Cisco AS5300 Access Server, the network guy had set IP Helpler to my C100 workstation, when he removed this entry the icmp packets disappeared ! The Access Server and my C100 are two completely different boxes and all they share is the same network.

We first saw the icmp packet by running the Tesseract program.

[Ron Kinner · Accepted solution]

Makes sense. IP helper takes a broadcast which is normally limited to a LAN and converts it to a unicast so it can be routed. Your box then received a bunch of Microsoft junk for ports it didn't listen on and each time a packet came in your box replied with an ICMP port unreachable. Don't see why it would have been a broadcast tho unless the return address of the original MS packet was 255.255.255.255

I'd say your network guy owes you a beer. He should have asked his router exactly what the ICMP packet was.

Ron