https://community.splunk.com/t5/Security/LWF-talking-on-UDP-137/m-p/79584#M2644 <P>This isn't anything Splunk is doing. If you take a look in /etc/services, you'll see that 137 is a NETBIOS (SAMBA, SMB) port. I'm not sure of what the purpose of this port is, as there are a number of SMB ports (137-139), but I would assume it's just some sort of broadcast to find out whether or not this box is NETBIOS accessible.</P> Tue, 12 Apr 2011 22:58:21 GMT amrit 2011-04-12T22:58:21Z https://community.splunk.com/t5/Security/LWF-talking-on-UDP-137/m-p/79583#M2643 <P>After installing the lightweight forwarder on a DMZ machine, I'm seeing UDP 137 traffic to my splunk server (which is being blocked by my firewall). Is this expected behaviour?</P> Tue, 12 Apr 2011 21:02:30 GMT https://community.splunk.com/t5/Security/LWF-talking-on-UDP-137/m-p/79583#M2643 garysmith 2011-04-12T21:02:30Z https://community.splunk.com/t5/Security/LWF-talking-on-UDP-137/m-p/79584#M2644 <P>This isn't anything Splunk is doing. If you take a look in /etc/services, you'll see that 137 is a NETBIOS (SAMBA, SMB) port. I'm not sure of what the purpose of this port is, as there are a number of SMB ports (137-139), but I would assume it's just some sort of broadcast to find out whether or not this box is NETBIOS accessible.</P> Tue, 12 Apr 2011 22:58:21 GMT https://community.splunk.com/t5/Security/LWF-talking-on-UDP-137/m-p/79584#M2644 amrit 2011-04-12T22:58:21Z https://community.splunk.com/t5/Security/LWF-talking-on-UDP-137/m-p/79585#M2645 <P>Did you ever find out the resolution for this ?<BR /> I am seeing the same after installing the Forwarder on my servers, they are all dropping on my ASAs</P> Mon, 01 Apr 2013 18:25:36 GMT https://community.splunk.com/t5/Security/LWF-talking-on-UDP-137/m-p/79585#M2645 GArienti 2013-04-01T18:25:36Z