LWF talking on UDP 137??

[garysmith]

After installing the lightweight forwarder on a DMZ machine, I'm seeing UDP 137 traffic to my splunk server (which is being blocked by my firewall). Is this expected behaviour?

[GArienti]

Did you ever find out the resolution for this ?
I am seeing the same after installing the Forwarder on my servers, they are all dropping on my ASAs

[amrit]

This isn't anything Splunk is doing. If you take a look in /etc/services, you'll see that 137 is a NETBIOS (SAMBA, SMB) port. I'm not sure of what the purpose of this port is, as there are a number of SMB ports (137-139), but I would assume it's just some sort of broadcast to find out whether or not this box is NETBIOS accessible.