I have Neowatch installed on my laptop. I have a dialup ISP connection at work. The ISP was Concentric Network and now is XO Communications. I get several attempted NetBIOS connections per hour. I’ve had this ISP for several years. This is a new experience. Is hacking on the rise? Has security at XO dropped? Could XO be doing this to make me paranoid and log off, thus freeing up their server?

What are the details? What are the source and destination ports?

66.236.97.101 da001d0357.stl-mo.osd.concentric.net, 66.236.96.87 da001d0087.stl-mo.osd.concentric.net , 66.236.96.185 da001d0185.stl-mo.osd.concentric.net, 200.64.141.162 dup-200-64-141-162.prodigy.net.mx, 162.39.200.8 h8.200.39.162.ip.alltel.net, 195.85.160.26 dialin-c3-85.160.26.freeaccess.nl, 66.236.97.32 da001d0288.stl-mo.osd.concentric.net are some of the sources. The events are usually NetBIOS sessions to port 139.

ISP's are constantly checking for service reports, usuage and other reports they use. They are not hacking you though. Some ISP's will disconnect you after a certain amount of time, if they do detect usuage. This is to save their resources sio they do not have to invest in more equipment. This is for the other users who are active, so their service does not slow down to crawl. Take care and all the best!

Badboy, Nothing to worry about... Perfectly normal traffic.

Thanks all!

Badboy, You,d be much safer online with your NetBios turned off! The easiest way is to simply rename your vnbt.386 to something else. If you want to do this & would like a very small program that turns it off & on, you can go here & download "close 139" it closes ports 137 138 & 139. http://home.earthlink.net/~rmbox/Reticulated/Toys.html If you are networked & do alot of file sharing the process is a little bit more complicated... I recommend you use a firewall, is neowatch a firewall? I have used NeoTrace before but not familiar with neowatch. With the info you give above a hacker could easily penetrate your system, ESPECIALLY seeing 139 is open.