We help IT Professionals succeed at work.

We've partnered with Certified Experts, Carl Webster and Richard Faulkner, to bring you two Citrix podcasts. Learn about 2020 trends and get answers to your biggest Citrix questions!Listen Now

x

netstat enquiry

mysticaljoey
mysticaljoey asked
on
Medium Priority
1,483 Views
Last Modified: 2008-01-09
Hi,

When i run netstat, i have a lots of this in my -server (2000 server)

TCP My-Server:2944     202.160.215.123: nebios-ssn     SYN_SENT
TCP My-Server:2945     202.160.215.123: epmap     SYN_SENT
TCP My-Server:2846     202.160.215.123: mirosoft_ds     SYN_SENT
and lots more identical foreign address with running port number on local address

Q1. What does all this foreign address neams? netbios -ssn,epmao,microsoft_ds

please help me

Comment
Watch Question

Author

Commented:
how can i block port, 127,138,139 and 445 in windows 2000 server it self?

Commented:
Hello mysticaljoey, To block ports manually, right klik on 'My Network Places', and select 'Properties' to open the 'Network Connections' folder. Right klik on the connection you want  and choose 'Properties'. Highlight the 'Internet Protocol' (TCP/IP) listing and choose 'Properties'. In the 'General' tab, click the 'Advanced' button. In the 'Advanced TCP/IP Settings dialogue box that appears, choose 'Options', highlight 'TCP/IP filtering', and choose 'Properties'. The 'TCP/IP filtering' dialogue box appears. To block TCP,UDP, and IP ports, choose the 'Permit Only' option for each. Since you don't want to block all your ports, you need to add the ports you want to allow access. For a complete list of ports, go to:  http://www.iana.org/assignments/port-numbers  
remember there are hundreds of ports used for internet, email, etc. Have you  tried running 'netstat' with the "-r" switch?  Might give you more info...I hope this helps.....Booda2us

Author

Commented:

i have try that which you have mention but it did not work but find another way to solved it using menthods that experts in here has mention it before.

Author

Commented:
but i still dont understand what are this, doing in my computer ?
TCP My-Server:2944     202.160.215.123: nebios-ssn     SYN_SENT
TCP My-Server:2945     202.160.215.123: epmap     SYN_SENT
TCP My-Server:2846     202.160.215.123: mirosoft_ds     SYN_SENT

please advice

Commented:
ping them..do a tracert and identify the source. Do a google search on the entries individually and see what results you get.

Commented:
If 202.160.215.123 is the real IP address your netstat is listing, here is the http://www.arin.net/whois/ information:

OrgName:    Asia Pacific Network Information Centre
OrgID:      APNIC
Address:    PO Box 2131
City:       Milton
StateProv:  QLD
PostalCode: 4064
Country:    AU

ReferralServer: whois://whois.apnic.net

NetRange:   202.0.0.0 - 203.255.255.255
CIDR:       202.0.0.0/7
NetName:    APNIC-CIDR-BLK
NetHandle:  NET-202-0-0-0-1
Parent:    
NetType:    Allocated to APNIC
NameServer: NS1.APNIC.NET
NameServer: NS3.APNIC.NET
NameServer: NS4.APNIC.NET
NameServer: TINNIE.ARIN.NET
NameServer: NS-SEC.RIPE.NET
NameServer: DNS1.TELSTRA.NET
Comment:    This IP address range is not registered in the ARIN database.
Comment:    For details, refer to the APNIC Whois Database via
Comment:    WHOIS.APNIC.NET or http://www.apnic.net/apnic-bin/whois2.pl
Comment:    ** IMPORTANT NOTE: APNIC is the Regional Internet Registry
Comment:    for the Asia Pacific region. APNIC does not operate networks
Comment:    using this IP address range and is not able to investigate
Comment:    spam or abuse reports relating to these addresses. For more
Comment:    help, refer to http://www.apnic.net/info/faq/abuse
Comment:    
RegDate:    1994-04-05
Updated:    2005-05-20

OrgTechHandle: AWC12-ARIN
OrgTechName:   APNIC Whois Contact
OrgTechPhone:  +61 7 3858 3100
OrgTechEmail:  search-apnic-not-arin@apnic.net

# ARIN WHOIS database, last updated 2006-10-28 19:10
# Enter ? for additional hints on searching ARIN's WHOIS database.

Going to Singapore?!?!  Looks like problems.  Initially, I'd think that if they are email servers, that it's some type of DNS lookup, but:

I'm assuming that nebios-ssn is netbios-ssn and mirosoft_ds is microsoft_ds.

netbios-ssn (139): http://www.experts-exchange.com/Operating_Systems/Q_21003902.html
epmap (593): http://www.dslreports.com/forum/remark,8092073
microsoft_ds (445): http://episteme.arstechnica.com/eve/forums/a/tpc/f/99609816/m/4900916855

Most of the ports you've mentioned have some type of security issue.  The origination address is suspicious... unless you deal with Singapore. I'd be worried, and start taking a hard look at my servers.  If nothing else, make sure that the ports you've listed are blocked at your Internet router... unless you have multiple office connections via the Internet and run full virus and spyware scans on your servers.

Best Wishes,

Jeffery Smith

Commented:
Put a firewall before the network/computers in question and set up strict rules.

Author

Commented:
hi,

how do i block null session from my w2k server

Author

Commented:
Hi,

yup i have menage to blokc them using notes from rpcfg and ipsecpol plus changing restrictanonymous port to 2

regards

Commented:
Sorry,
 
For some reason, I never got an email ping on your question about blocking a null session.  Glad you got it fixed.

Best Wishes,

Jeffery Smith

Commented:
I'm glad i could help...Booda
PAQed with points refunded (500)

Computer101
EE Admin

Not the solution you were looking for? Getting a personalized solution is easy.

Ask the Experts
Access more of Experts Exchange with a free account
Thanks for using Experts Exchange.

Create a free account to continue.

Limited access with a free account allows you to:

  • View three pieces of content (articles, solutions, posts, and videos)
  • Ask the experts questions (counted toward content limit)
  • Customize your dashboard and profile

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

OR

Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.