Solved

SIP on Windows 2000

Posted on 2009-05-05
4
311 Views
Last Modified: 2013-11-16
I have just taken over some older windows 2000 servers that house a client server application. A recent scan from the Security Operations Center tells me that I have SIP services running and I need to justify having them or remove them. As far as I know, SIP is for IP telephony and we don't use anything like that on our servers. How do I go about disabling this? And is this wise?
0
Comment
Question by:RBmuzac
  • 2
  • 2
4 Comments
 
LVL 33

Expert Comment

by:Dave Howe
ID: 24307633
it sounds unlikely - sip is (indeed) a form of voice over ip, usually on udp, and almost invariably on ports 5060 or 5061. There is some interplay between that and OCS, if you are running that, but I doubt strongly that is going to be on a win2k server.

It sounds more likely that *something* is running on port 5060 and/or 5061, and your SOC can't tell the difference between a random app on those ports and a real sip server.

I would suggest the easiest method is to use tcpview (from the sysinternals/microsoft site -
http://technet.microsoft.com/en-us/sysinternals/bb897437.aspx - and see what is running on that port. If it is non-obvious what it is that is running (its a service under svchost) then note the process id, and look THAT up using process explorer - http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx

I suspect you will find that it is something harmless, but check with your SOC that they are just concerned that SOMETHING is running on 5060 (and if not, ask them what it is they *are* reporting so you can investigate further)
0
 

Author Comment

by:RBmuzac
ID: 24317881
They sent me this text of the scan:

Starting Nmap 4.76 ( http://nmap.org ) at 2009-05-04 09:02 MDT
Interesting ports on 161.X.X.X
Not shown: 988 closed ports
PORT     STATE    SERVICE       VERSION
111/tcp  open     rpcbind
135/tcp  open     msrpc         Microsoft Windows RPC
139/tcp  open     netbios-ssn
445/tcp  open     microsoft-ds  Microsoft Windows 2000 microsoft-ds
1032/tcp open     msrpc         Microsoft Windows RPC
1095/tcp open     msrpc         Microsoft Windows RPC
1720/tcp filtered H.323/Q.931
2000/tcp filtered callbook
3372/tcp open     msdtc?
3389/tcp open     microsoft-rdp Microsoft Terminal Service
5060/tcp filtered sip
6502/tcp open     msrpc         Microsoft Windows RPC
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at http://www.insecure.org/cgi-bin/servicefp-submit.cgi :
SF-Port3372-TCP:V=4.76%I=7%D=5/4%Time=49FF0379%P=i686-pc-linux-gnu%r(GetRe
SF:quest,6,"P\x9a\n\0x\x01")%r(RTSPRequest,6,"P\x9a\n\0x\x01")%r(HTTPOptio
SF:ns,6,"P\x9a\n\0x\x01")%r(Help,6,"P\x9a\n\0x\x01")%r(SSLSessionReq,6,"P\
SF:x9a\n\0x\x01")%r(FourOhFourRequest,6,"P\x9a\n\0x\x01")%r(LPDString,6,"P
SF:\x9a\n\0x\x01")%r(SIPOptions,6,"P\x9a\n\0x\x01");
Service Info: OS: Windows

Host script results:
|  Discover OS Version over NetBIOS and SMB: Windows 2000
|_ Discover system time over SMB: 2009-05-04 09:03:24 UTC-4

Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 76.04 seconds

Honestly I don't know what to make of it. I downloaded the tools that you pointed out and  was not able to come to a conclusion. I didn't see anything with regards to port 5060. Is there anything else you can tell me about this? Thanks
0
 
LVL 33

Accepted Solution

by:
Dave Howe earned 500 total points
ID: 24318632
ok, they have ran a very basic portscanner called "nmap"

While I say it is "basic", that isn't to say it isn't good - nmap is considered to be the best portscanner in existence, and many other pentesting applications just import its results rather than even attempting to come close to its ability - but scanning ports is *all* it can do; it gives you a list of ports that were responding with a handshake ("open") and a list of those who didn't even respond with a "RST" - which aren't open, but which they can't call definitively closed either. This is common when you attempt a tcp handshake to a udp port, which isn't ready to accept tcp, but which isn't closed either.

I would suggest initially that you re-run the test yourself - you can do this trivially, as nmap is free and available from http://nmap.org/download.html, and will run happily on a random windows xp workstation

Further, in the tcpview application, you should first untick "resolve addresses" from the options menu, then sort by state -  by clicking that title bar.

if you look down the list, you should (if there really is something listening there) see an entry for UDP 0.0.0.0:5060 under "local address" with "listening" as the state. the far left entry ("process") should give a program name, followed by a number. the number is the process ID, which can then be looked up in process explorer. TCPView is a key diagnostic tool for cases of this type, although there are more detailed tools to cover a multitude of networking and process functions also available from the microsoft site.
0
 

Author Closing Comment

by:RBmuzac
ID: 31578124
Thanks Dave. That worked! You are the man!
0

Featured Post

6 Surprising Benefits of Threat Intelligence

All sorts of threat intelligence is available on the web. Intelligence you can learn from, and use to anticipate and prepare for future attacks.

Join & Write a Comment

In a recent article here at Experts Exchange (http://www.experts-exchange.com/articles/18880/PaperPort-14-in-Windows-10-A-First-Look.html), I discussed my nine-month sandbox testing of the Windows 10 Technical Preview, specifically with respect to r…
Users of Windows 10 Professional can disable automatic reboots using the policy editor. This tool is not included in the Windows home edition. But don't worry! Follow the instructions below to install (a Win7) policy editor on your Windows 10 Home e…
It is a freely distributed piece of software for such tasks as photo retouching, image composition and image authoring. It works on many operating systems, in many languages.
Internet Business Fax to Email Made Easy - With eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, fr…

747 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now