Comcast inherited many systems when it purchased ATT Broadband, which in turn, inherited many systems when it purchased MediaOne. MediaOne blocked ports 137-139 for most of its lifetime, and I believe it's successors have done the same. I'd bet they block port 135 as well. The original rationale for this policy was to protect open fileshares on Windows computers from snooping.

For those who don't like this policy, you can asked to be removed from the block list, as I have done. I firewall my Comcast connection (with Linux), so I didn't need ISP filtering as well.

You might therefore be interested in the fact that the firewalls I manage that are connected to commercial providers were hit many more times by the worm than was my Comcast connection. For instance, I logged about 1100 port 135 packets on a firewall connected to XO line, compared to about 100 packets on my Comcast cable modem connection.

I agree with the earlier poster that packets with forged private addresses, smurf packets, and the like, should never leave an ISP's router.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/6728/21542#21542