Re: [OT: security] smbclient

FROM : Jens Alfke
DATE : Tue Apr 15 23:09:21 2008

On 15 Apr '08, at 12:52 PM, Stuart Malin wrote:

> I run Little Snitch and it has popped up that smbclient wants to 
> connect to some server (169.254.44.184)


169.254.*.* is the self-assigned address range. If a computer connects 
to a LAN but finds no router or DHCP server on it (and it doesn't have 
a static address configured), it'll pick a random IP address out of 
that range. This allows a group of computers on a bare Ethernet, or a 
computer-to-computer AirPort network, use TCP/IP with no special 
configuration.

> on port 139 (netbios-ssn).


I think this is part of Windows' LAN support, a DHCP-like protocol for 
configuring local networks. Not sure why the smbclient would be trying 
to connect to it, or even running at all.

—Jens

PS: Just replying here so this thread doesn't get left dangling as 
some scary "OMG a virus" thing. But further follow-ups should 
definitely go someplace else.