Non standard port 9001 and 9030 TCP traffic observed permitted to DC

We have been receiving alerts that a domain controller and other hosts have been communicating on port 9001 and 9030.  From a security perspective this is a concern as these are not standard ports and have been tied to tor relay ports.

The question is whether there are any known or valid services or benign reasons that would use ports 9001 or 9030 in a windows environment be it a DC or server 2008/2012/2016?
Bill BurrIT AdminAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

arnoldCommented:
does the DCs serve any other function?
0
masnrockCommented:
We have been receiving alerts that a domain controller and other hosts have been communicating on port 9001 and 9030.  From a security perspective this is a concern as these are not standard ports and have been tied to tor relay ports.
Tor is actually one program that uses both of those ports. And I've noticed you even tagged Tor as one of the topics on here.... which would actually encourage me to turn around and ask whether it's an authorized application in your environment.

Sharepoint is another that can use port 9001.
0
arnoldCommented:
forgot, run in an elevated command window
netstat -anb | more  and see which service is bound to port 9001, 9030
sysinternals include utilities such as tcpview, process explorer that might be useful in identifying the process that is bound/using port 9001, 9030...
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Bill BurrIT AdminAuthor Commented:
Thanks guys - this is just what the dr ordered
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Tor

From novice to tech pro — start learning today.