Multiple micosoft-ds connection. Too many????

We have a lot of microsoft-ds connections between our W3K and W2K box.  (see netstat output below).  The W2K (server.plaza.local) box is our file/print server, Domain controller and Pervasive SQL Server.  Our W3K (pptermserver) box is our Terminal Server for RDP access.  It also performs IIS, SMTP relay, and has a Pervasive engine that polls data from the W2K box for displaying in a web page.

Does this seem normal for our setup?
Active Connections
 
  Proto  Local Address          Foreign Address        State
  TCP    pptermserver:microsoft-ds  pptermserver.plaza.local:1224  ESTABLISHED
  TCP    pptermserver:1224      pptermserver.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:1036      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:1072      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:1155      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:1187      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:1289      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:1321      plazahd.plaza.local:8010  FIN_WAIT_2
  TCP    pptermserver:1342      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:1349      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:1545      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:1592      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:1623      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:1627      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:1648      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:1667      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:1675      plazahd.plaza.local:8010  FIN_WAIT_2
  TCP    pptermserver:1768      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:1887      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:1906      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:1920      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:1923      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:1956      server.plaza.local:netbios-ssn  ESTABLISHED
  TCP    pptermserver:2015      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:2075      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:2113      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:2137      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:2219      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:2330      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:2338      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:2387      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:2407      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:2419      plazahd.plaza.local:8010  FIN_WAIT_2
  TCP    pptermserver:2476      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:2549      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:2627      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:2665      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:sms-xfer  server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:msolap-ptp2  corpws041.plaza.local:8010  FIN_WAIT_2
  TCP    pptermserver:2807      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:2819      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:2840      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:2983      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:2993      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:3028      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:3050      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:3053      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:3095      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:3129      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:3150      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:3185      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:3199      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:3219      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:3226      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:3302      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:3320      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:3347      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:3361      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:ms-wbt-server  ibc-74-218-63-114.insight-bc.com:61446  ESTABLISHED
  TCP    pptermserver:ms-wbt-server  sonyvgn-sz220.plaza.local:49524  ESTABLISHED
  TCP    pptermserver:ms-wbt-server  corpws041.plaza.local:3681  ESTABLISHED
  TCP    pptermserver:3447      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:3452      plazahd.plaza.local:8010  FIN_WAIT_2
  TCP    pptermserver:3483      plazahd.plaza.local:8010  FIN_WAIT_2
  TCP    pptermserver:3518      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:3533      plazahd.plaza.local:8010  FIN_WAIT_2
  TCP    pptermserver:3692      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:3763      server.plaza.local:netbios-ssn  ESTABLISHED
  TCP    pptermserver:3884      server.plaza.local:microsoft-ds  TIME_WAIT
  TCP    pptermserver:3902      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:3909      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:3924      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:3952      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:3960      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:3966      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:3976      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:3977      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:3980      corpws041.plaza.local:8010  FIN_WAIT_2
  TCP    pptermserver:3982      corpws041.plaza.local:8010  FIN_WAIT_2
  TCP    pptermserver:3995      corpws041.plaza.local:8010  FIN_WAIT_2
  TCP    pptermserver:4034      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:4061      plazahd.plaza.local:8010  FIN_WAIT_2
  TCP    pptermserver:4093      plazahd.plaza.local:8010  FIN_WAIT_2
  TCP    pptermserver:4123      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:4166      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:4207      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:4248      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:4284      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:4290      server.plaza.local:3351  ESTABLISHED
  TCP    pptermserver:4309      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:4334      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:4372      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:4381      server.plaza.local:3351  ESTABLISHED
  TCP    pptermserver:4405      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:4481      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:4484      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:4491      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:4526      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:4546      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:4585      server.plaza.local:3351  ESTABLISHED
  TCP    pptermserver:4592      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:4594      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:4601      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:4668      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:4695      server.plaza.local:netbios-ssn  ESTABLISHED
  TCP    pptermserver:4696      plazahd.plaza.local:8010  TIME_WAIT
  TCP    pptermserver:4702      server.plaza.local:microsoft-ds  TIME_WAIT
  TCP    pptermserver:4710      server.plaza.local:microsoft-ds  TIME_WAIT
  TCP    pptermserver:4754      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:4786      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:4841      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:4872      server.plaza.local:microsoft-ds  ESTABLISHED
  TCP    pptermserver:4922      server.plaza.local:netbios-ssn  ESTABLISHED
  TCP    pptermserver:4942      plazahd.plaza.local:8010  FIN_WAIT_2
  TCP    pptermserver:4958      plazahd.plaza.local:8010  FIN_WAIT_2
  TCP    pptermserver:4967      plazahd.plaza.local:8010  FIN_WAIT_2
  TCP    pptermserver:4999      server.plaza.local:microsoft-ds  ESTABLISHED

Open in new window

LVL 1
PlazaPropAsked:
Who is Participating?

Improve company productivity with a Business Account.Sign Up

x
 
tigermattConnect With a Mentor Commented:

There's nothing wrong with the number of connections you are seeing there. It's perfectly normal for there to be large numbers of microsoft-ds connections between servers and back to Domain Controllers, particularly on servers which are utilised quite highly.

-Matt
0
 
PlazaPropAuthor Commented:
Could the traffic be configured by the Confiker worm or a variant of it?  I read that Confiker uses port 445 which is used by Windows for SMB.  That box has the appropriate MS patch applied to it back in 12 / 2008.  
0
 
tigermattConnect With a Mentor Commented:

Theoretically, it could be. Conflicker is a complicated worm which infects machines on a number of levels, so this type of infection cannot be ruled out.

Use the KidoKiller tool from Kaspersky Labs to search your server to determine if you are infected: http://support.kaspersky.com/faq/?qid=208279973. Also consider running the Malicious Software Removed Tool from Microsoft, to check for other forms of infection: http://www.microsoft.com/security/malwareremove/default.mspx

-Matt
0
 
PlazaPropAuthor Commented:
Ok, thanks for the input.  I went to Mcafee site and got their Confiker test program ( http://www.mcafee.com/us/enterprise/confickertest.html ).  The computer tested "no infected"  so I guess this is just normal traffic.  But, I will continue to monitor just in case.
0
 
tigermattCommented:
A 'B' grade? Can you clarify why? I told you this is normal behaviour, and gave you two different routes to follow to verify it is not caused by a malicious worm or bot.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.