Strange network traffic out to UDP port 137 from Brave

Browser Support Desktop Support
1

Description of the issue:

When using Brave on Windows 10 I see some outbound connection requests on UDP port 137 to assorted computers on the Internet. I do not see this when using other browsers. Why?

Steps to Reproduce (add as many as necessary): 1. 2. 3.

Set router or firewall to notify every time an outbound request is made on UDP port 137. Then just run Brave and wait.

Actual Result (gifs and screenshots are welcome!):

Log from router/firewall

18:21:13 Denied SRC=192.168.3.224 DST=104.28.22.242 PROTO=UDP SPT=137 DPT=137
18:21:11 Denied SRC=192.168.3.224 DST=104.28.22.242 PROTO=UDP SPT=137 DPT=137
18:21:10 Denied SRC=192.168.3.224 DST=104.28.22.242 PROTO=UDP SPT=137 DPT=137
18:19:33 Denied SRC=192.168.3.224 DST=151.101.21.7 PROTO=UDP SPT=137 DPT=137
18:19:33 Denied SRC=192.168.3.224 DST=151.101.21.7 PROTO=UDP SPT=137 DPT=137
18:19:33 Denied SRC=192.168.3.224 DST=151.101.65.7 PROTO=UDP SPT=137 DPT=137
18:19:31 Denied SRC=192.168.3.224 DST=151.101.21.7 PROTO=UDP SPT=137 DPT=137
18:19:31 Denied SRC=192.168.3.224 DST=151.101.21.7 PROTO=UDP SPT=137 DPT=137
18:19:31 Denied SRC=192.168.3.224 DST=151.101.65.7 PROTO=UDP SPT=137 DPT=137
18:19:30 Denied SRC=192.168.3.224 DST=151.101.21.7 PROTO=UDP SPT=137 DPT=137
18:19:30 Denied SRC=192.168.3.224 DST=151.101.21.7 PROTO=UDP SPT=137 DPT=137
18:19:30 Denied SRC=192.168.3.224 DST=151.101.65.7 PROTO=UDP SPT=137 DPT=137
18:16:21 Denied SRC=192.168.3.224 DST=151.101.21.7 PROTO=UDP SPT=137 DPT=137
18:16:20 Denied SRC=192.168.3.224 DST=151.101.21.7 PROTO=UDP SPT=137 DPT=137
18:16:18 Denied SRC=192.168.3.224 DST=151.101.21.7 PROTO=UDP SPT=137 DPT=137

Expected result:

No traffic to UDP port 137. Its a LAN thing, not a WAN thing.

Reproduces how often:

Sometimes

Operating System and Brave Version(See the About Brave page in the main menu):

Windows 10
Brave version 0.66.99 (Chrome 75.0.3770.100) Official Build 64 bit.

Additional Information:

More details are here
https://www.michaelhorowitz.com/BraveBrowserUDP137.php

2

Hi @user2387,

Thanks for your post! Thanks for reporting your issue.

@sriram would you mind taking a look at this?

3

@user2387 Sorry for the delayed reply but I really liked the clean report on your page. Wish everyone reports things in detail like this.

So what you are seeing is nothing unusual. Brave installs components which are downloaded as the browser is opened. For example, Tracking protection/HTTPSE ruleset/ Safe browsing ruleset etc are downloaded/checked for updates when the browser is launched. All these go via Brave proxy which you have listed on your page. Also, every time the browser is launched a background update process is also launched automatically which you have also captured in your report. If you have sync enabled in your browser then there will be frequent calls to the sync server to check for updates which is also normal and will show up in your network scan. If you have rewards enabled, then each launch will trigger a download for verified publishers list which will also create a connection.

As long as you have downloaded via brave.com/download and installed all these are normal connections that happen which are not strange connections. You can visit brave://components and see all Brave components that get downloaded.

Hope this helps. Please let me know if you still need any clarifications

1 Like
4

This topic was automatically closed after 30 days. New replies are no longer allowed.