LWF talking on UDP 137??

garysmith · ‎04-12-2011

After installing the lightweight forwarder on a DMZ machine, I'm seeing UDP 137 traffic to my splunk server (which is being blocked by my firewall). Is this expected behaviour?

GArienti · ‎04-01-2013

Did you ever find out the resolution for this ?
I am seeing the same after installing the Forwarder on my servers, they are all dropping on my ASAs

amrit · ‎04-12-2011

This isn't anything Splunk is doing. If you take a look in /etc/services, you'll see that 137 is a NETBIOS (SAMBA, SMB) port. I'm not sure of what the purpose of this port is, as there are a number of SMB ports (137-139), but I would assume it's just some sort of broadcast to find out whether or not this box is NETBIOS accessible.

LWF talking on UDP 137??

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

A Four-Part Event Series: Full Stack Observability For the AI Era

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

Join the Conversation

LWF talking on UDP 137??

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

A Four-Part Event Series: Full Stack Observability For the AI Era

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security