Random UDP 137 to Public IP's after connecting global protect

Showing results for 
Show  only  | Search instead for 
Did you mean: 
Please sign in to see details of an important advisory in our Customer Advisories area.

Random UDP 137 to Public IP's after connecting global protect

L1 Bithead

After installing and connecting to Global Protect, FW policy logs are showing large amounts of UDP 137 getting blocking from Global Protect clients going to many random Public IP's.  Any idea what would cause this?  Public IP's have been MS, AWS, Google owned.


L1 Bithead

A little more information:


This only seems to happen when global protect client is active, and doesn't happen on all clients.


The UDP 137 traffic is Net Bios Name Query (Appears to be reverse lookup)


Name query NBSTAT *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> to random Public IP's




  • 1 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!