Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

thousands of requests coming from our domain controllers, over port 139

Posted on 2014-02-24
3
Medium Priority
?
102 Views
Last Modified: 2015-01-06
i got an email from our network engineer that there are 2 servers on our network that are probing multiple machines on other networks in our WAN
the 2 servers are active directory domain controllers, and they are sending out requests over port 139
how can i tell what program is running on this machine that is probing port 139 from our DC
0
Comment
Question by:jsctechy
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
3 Comments
 
LVL 8

Expert Comment

by:Shahnawaz Ahmed
ID: 39883679
Dear jsctechy

You can use TCPView by SysInternals (i.e. Microsoft) is a great tool. or I think you may want to try out netstat.exe, which is typically located at C:\WINNT\system32\netstat.exe .

A help page is available with

netstat -?

Examples are:

netstat -a

Lists all local TCP connections and listening ports together with remote TCP endpoint.

netstat -o

Adds the process ID to the output.

netstat -b

Gives you the name of the executable wich was involved in establising this connection/port.
0
 
LVL 8

Accepted Solution

by:
Shahnawaz Ahmed earned 2000 total points
ID: 39883685
You will find TCPView more helpful as its GUI and you don't need to install.
You can download from FTP - live.sysinternals.com
0
 
LVL 1

Author Comment

by:jsctechy
ID: 39884163
thanks shahnawaz, tcpview is
SYSTEM PROCESS
PID: 0
TCP
(hostname is the local address)
54039 is one of the local ports
remote address is a hostname of a pc in a different office,
microsoft-ds is one of the remote ports
state is time_wait
0

Featured Post

Ransomware: The New Cyber Threat & How to Stop It

This infographic explains ransomware, type of malware that blocks access to your files or your systems and holds them hostage until a ransom is paid. It also examines the different types of ransomware and explains what you can do to thwart this sinister online threat.  

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Group policies can be applied selectively to specific devices with the help of groups. Utilising this, it is possible to phase-in group policies, over a period of time, by randomly adding non-members user or computers at a set interval, to a group f…
Compliance and data security require steps be taken to prevent unauthorized users from copying data.  Here's one method to prevent data theft via USB drives (and writable optical media).
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …
Suggested Courses

721 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question