Ah, Microsoft File and Print Sharing. The bane of existence for anyone who is concerned with security and has to support a Windows network!
Ok, here is the deal. File and Print Sharing is enabled on all Windows machines by default. It lets you map a drive, print to a remote printer, and get details from a remote Windows machine. All of that runs over NetBIOS over TCP/IP.
There are several ports associated with NetBIOS. UDP port 137 is the NetBIOS name port; you can do a NBTSTAT against a remote system, and get the machine name and logged-on user name that way.
File sharing and mapped drives works on TCP port 139.
Also you must remember that the entire Windows 9x line (95, 98 & ME) do NOT have any security settings in place at all! So, on a default 9X box, ANYONE can remotely connect to them and VIEW THEIR ENTIRE FILE CONTENTS!!!
So, this is the problem that faces the world, only the world does NOT know about this. Here is an example. I run a software firewall (ZoneAlarm) on my laptop. I connect to the Internet via dialup only. On Saturday, my firewall blocked 32 different NetBIOS connection attempts over a 2 hour period! 32 different people from all over (USA, Spain, Korea, Ireland) tried to connect to my machine.
People remotely connecting over the Internet is a big problem, one that us in the IT industry must be concerned about.
Now, the client company that has their Cisco PIX firewall that open should be ashamed of themselves!!! They need to lock that down now!
As to why you can sometimes connect to that IP and sometimes not, maybe that system is not always on! Either way, it obviously is not running a firewall, because firewalls block NetBIOS by default, normally.
If you want to know more about this, read this article on the GRC web site:
http://grc.com/su-bondage.htm
And stop connecting to that remote system! The owner of it doesn't know they are vulnerable.
