Source port of Samba Scans?

[swan_daniel () my-deja com (Daniel Swan)]

Looking at my logs, I see a lot of Samba scans... I think it's a fair assumption that Legion is being used in most 
cases.  (If this is not a fair assumption, please let me know!).

Sometimes the source port is something random, above 1024, which I assume is just a dynamically allocated port... but 
in other cases, it is
137.

So how do we account for the two different cases here...  is it different tools, different OS's... or what?

--== Sent via Deja.com http://www.deja.com/ ==--
Share what you know. Learn what you don't.