PC using port 445 uses most bandwidth on WAN

Daves166
Daves166 used Ask the Experts™
on
Our company has 7 sites. Each site has it's own AD server.  Each AD server replicates with our data center.  I have a PC that when it logs on it goes to another site and accesses info on it's AD server. It uses source port 445 and destination port of 63102.    We have McAfee and I've scanned it looking for virus' (nothing there).  This PC doesn't come on that often but when it does it hammers our WAN for about 10-15 minutes then it settles down.  The source site has a T1 while the remote site has 10MB connection. Any idea of what it is trying to do?
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Qlemo"Batchelor", Developer and EE Topic Advisor
Top Expert 2015
Commented:
"Source port 445" is suspicious, because this needs to be the destination port. So it looks like the remote site gets CIFS (file system) info from that machine.
Sr. Systems Administrator
Commented:
Download wireshark and mirror that port. You need to capture the packets as they are flooding your connection. How are you routing from the remote site? You may be able to configure your router to capture the traffic for you. 445 is a legit windows port for SMB, but if you do not expect the traffic, the machine in question may be already owned. Do a rootkit scan with not McAfee and see what you come up with.

Author

Commented:
Qlemo,
In my software it says Source port. But that may actually be the destination because of the circuit I was looking at.  I'll have to look at what CIFS info it is looking for on the far server

Author

Commented:
RantCan,
I'll have to get wireshark and look at the traffic.  I haven't used it very much so I'll try and muddle through the program.  We ran a rootkit and every other program McAfee had for us.  They all came back clean.
RantCanSr. Systems Administrator

Commented:
Roger that. You might try a different A/V just to be sure.

https://wiki.wireshark.org/

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial