Citrix PS's connecting to another server on ports 139/445

Hi All

We have a group of Citrix 4.0 Presentation servers; PS1, PS2 etc.

There is also another server in the network, Server1.

We've noticed that some of the Presentation Servers are connecting to Server1 on ports 139 and 445. I cannot think of any reason why?

Anyone have any idea?
LVL 1
Joe_BuddenAsked:
Who is Participating?
 
zoubi77Connect With a Mentor Commented:
This has basicly nothing to do with Citrix. Those two ports are for MS file and printer sharing. You can investigate more by running NETSTAT -nao on one of the servers to see what process has established connection.

If you do not use file and printer sharing on SERVER1 than you can uncheck the appropriate box on properties of network card
0
 
Joe_BuddenAuthor Commented:
So does this mean a Citrix session is attempting to ap a drive/printer to Server1?

Also, what would Netstat -nao show, I've not heard of this?
0
 
zoubi77Commented:
NETSTAT is network tool used for analyzing connection sockeds. It will show you which process is listening on which port. It will also show you which process established network connections, so it will help you determine the cause.

But I don't think that you should worry about this if you have good antivirus protection (some trojans can make connections on 139 and 445).

I assume that server1 is not Citrix server. Do you have any shares on that server??
0
 
Joe_BuddenAuthor Commented:
Server1 is not a Citrix server - I will find out if we have any shares on that server.

Where do we need to run Netstat on, the Citrix server or Server1?
0
 
zoubi77Commented:
It does not matter where you run NETSTAT as it shows established connections (if there is a connection it will show up on both servers). If you want to see what is connecting to server1 from your citrix farm, run it on server in citrix farm and vice versa

Run 'netstat -ba' (without quotes and it will show you what process is runninig on which socket (previously I said 'netstat -nao', what will show you wich PID is listening on which socket.

You can send output of netstat -nb and netstat -nao , so I can tell you what is going on
0
All Courses

From novice to tech pro — start learning today.