Go Premium for a chance to win a PS4. Enter to Win

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1349
  • Last Modified:

netstat enquiry

Hi,

When i run netstat, i have a lots of this in my -server (2000 server)

TCP My-Server:2944     202.160.215.123: nebios-ssn     SYN_SENT
TCP My-Server:2945     202.160.215.123: epmap     SYN_SENT
TCP My-Server:2846     202.160.215.123: mirosoft_ds     SYN_SENT
and lots more identical foreign address with running port number on local address

Q1. What does all this foreign address neams? netbios -ssn,epmao,microsoft_ds

please help me

0
mysticaljoey
Asked:
mysticaljoey
  • 5
  • 3
  • 2
  • +2
1 Solution
 
mysticaljoeyAuthor Commented:
how can i block port, 127,138,139 and 445 in windows 2000 server it self?

0
 
Booda2usCommented:
Hello mysticaljoey, To block ports manually, right klik on 'My Network Places', and select 'Properties' to open the 'Network Connections' folder. Right klik on the connection you want  and choose 'Properties'. Highlight the 'Internet Protocol' (TCP/IP) listing and choose 'Properties'. In the 'General' tab, click the 'Advanced' button. In the 'Advanced TCP/IP Settings dialogue box that appears, choose 'Options', highlight 'TCP/IP filtering', and choose 'Properties'. The 'TCP/IP filtering' dialogue box appears. To block TCP,UDP, and IP ports, choose the 'Permit Only' option for each. Since you don't want to block all your ports, you need to add the ports you want to allow access. For a complete list of ports, go to:  http://www.iana.org/assignments/port-numbers  
remember there are hundreds of ports used for internet, email, etc. Have you  tried running 'netstat' with the "-r" switch?  Might give you more info...I hope this helps.....Booda2us
0
 
mysticaljoeyAuthor Commented:

i have try that which you have mention but it did not work but find another way to solved it using menthods that experts in here has mention it before.
0
Get your Conversational Ransomware Defense e‑book

This e-book gives you an insight into the ransomware threat and reviews the fundamentals of top-notch ransomware preparedness and recovery. To help you protect yourself and your organization. The initial infection may be inevitable, so the best protection is to be fully prepared.

 
mysticaljoeyAuthor Commented:
but i still dont understand what are this, doing in my computer ?
TCP My-Server:2944     202.160.215.123: nebios-ssn     SYN_SENT
TCP My-Server:2945     202.160.215.123: epmap     SYN_SENT
TCP My-Server:2846     202.160.215.123: mirosoft_ds     SYN_SENT

please advice
0
 
Booda2usCommented:
ping them..do a tracert and identify the source. Do a google search on the entries individually and see what results you get.
0
 
JeffesmiCommented:
If 202.160.215.123 is the real IP address your netstat is listing, here is the http://www.arin.net/whois/ information:

OrgName:    Asia Pacific Network Information Centre
OrgID:      APNIC
Address:    PO Box 2131
City:       Milton
StateProv:  QLD
PostalCode: 4064
Country:    AU

ReferralServer: whois://whois.apnic.net

NetRange:   202.0.0.0 - 203.255.255.255
CIDR:       202.0.0.0/7
NetName:    APNIC-CIDR-BLK
NetHandle:  NET-202-0-0-0-1
Parent:    
NetType:    Allocated to APNIC
NameServer: NS1.APNIC.NET
NameServer: NS3.APNIC.NET
NameServer: NS4.APNIC.NET
NameServer: TINNIE.ARIN.NET
NameServer: NS-SEC.RIPE.NET
NameServer: DNS1.TELSTRA.NET
Comment:    This IP address range is not registered in the ARIN database.
Comment:    For details, refer to the APNIC Whois Database via
Comment:    WHOIS.APNIC.NET or http://www.apnic.net/apnic-bin/whois2.pl
Comment:    ** IMPORTANT NOTE: APNIC is the Regional Internet Registry
Comment:    for the Asia Pacific region. APNIC does not operate networks
Comment:    using this IP address range and is not able to investigate
Comment:    spam or abuse reports relating to these addresses. For more
Comment:    help, refer to http://www.apnic.net/info/faq/abuse
Comment:    
RegDate:    1994-04-05
Updated:    2005-05-20

OrgTechHandle: AWC12-ARIN
OrgTechName:   APNIC Whois Contact
OrgTechPhone:  +61 7 3858 3100
OrgTechEmail:  search-apnic-not-arin@apnic.net

# ARIN WHOIS database, last updated 2006-10-28 19:10
# Enter ? for additional hints on searching ARIN's WHOIS database.

Going to Singapore?!?!  Looks like problems.  Initially, I'd think that if they are email servers, that it's some type of DNS lookup, but:

I'm assuming that nebios-ssn is netbios-ssn and mirosoft_ds is microsoft_ds.

netbios-ssn (139): http://www.experts-exchange.com/Operating_Systems/Q_21003902.html
epmap (593): http://www.dslreports.com/forum/remark,8092073
microsoft_ds (445): http://episteme.arstechnica.com/eve/forums/a/tpc/f/99609816/m/4900916855

Most of the ports you've mentioned have some type of security issue.  The origination address is suspicious... unless you deal with Singapore. I'd be worried, and start taking a hard look at my servers.  If nothing else, make sure that the ports you've listed are blocked at your Internet router... unless you have multiple office connections via the Internet and run full virus and spyware scans on your servers.

Best Wishes,

Jeffery Smith
0
 
BJHarrisCommented:
Put a firewall before the network/computers in question and set up strict rules.
0
 
mysticaljoeyAuthor Commented:
hi,

how do i block null session from my w2k server
0
 
mysticaljoeyAuthor Commented:
Hi,

yup i have menage to blokc them using notes from rpcfg and ipsecpol plus changing restrictanonymous port to 2

regards
0
 
JeffesmiCommented:
Sorry,
 
For some reason, I never got an email ping on your question about blocking a null session.  Glad you got it fixed.

Best Wishes,

Jeffery Smith
0
 
Booda2usCommented:
I'm glad i could help...Booda
0
 
Computer101Commented:
PAQed with points refunded (500)

Computer101
EE Admin
0

Featured Post

Free Tool: SSL Checker

Scans your site and returns information about your SSL implementation and certificate. Helpful for debugging and validating your SSL configuration.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

  • 5
  • 3
  • 2
  • +2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now