Re: exchange server attempting to connect to odd ports

From: Roman Daszczyszak (romandas_at_gmail.com)
Date: 07/14/05

  • Next message: sanjiv: "Changing Windows domain password over Internet" 
    Date: Thu, 14 Jul 2005 13:07:57 +0200
To: "focus-ms@securityfocus.com" <focus-ms@securityfocus.com>

    Have you tried using a utility like Active Ports
    (http://www.ntutility.com) or TCPview (www.sysinternals.com) to check
    what ports are being opened on your box, and by what process?

    Also, you can sniff the network traffic and see what types of packets
    are being sent out.

    Regards,
    Roman
    > -----Original Message-----
    > From: Matt Bazan [mailto:Mbazan@onelegal.com]
    > Sent: Tuesday, July 05, 2005 4:39 PM
    > To: focus-ms@securityfocus.com
    > Subject: exchange server attempting to connect to odd ports
    >
    > Just rebuilt our exchange box and I see it trying to open connections to
    > the following udp ports:
    >
    > 1140
    > 3069
    >
    > This is happening to a 192.168 IP address so it's not getting far but I
    > find it curious. Happens every minute or so. Have scanned for spyware
    > and run AV software on the box and both have come up empty. Any other
    > ideas? Thanks.
    >
    > Matt
    <snip>

    ---------------------------------------------------------------------------
    ---------------------------------------------------------------------------

  • Next message: sanjiv: "Changing Windows domain password over Internet"

    Relevant Pages

    • Re: Open Ports required for RFC over HTTP
      ... We are using a cert issued by Geotrust. ... issued our cert, it was issued for the Cname, and worked fine. ... I asked them what ports they block, ... we can successfully connect to the exchange server. ...
      (microsoft.public.exchange.setup)
    • Re: Exchange connectivity through Firewall
      ... Considering the connections from Org A to Org B network will always ... will firewall forward rules to a target ... Exchange server will only see the external interface of the firewall as the ... I understand that Exchange 2000 services can be hard coded to certain ports ...
      (microsoft.public.exchange2000.connectivity)
    • RE: Mail connectors and pdf size limit?
      ... attachmenys mentioned in the second document were also disabled for incoming. ... and added the ports into the reservered ports restarting the server ... If you are using SBS 2003 server, please rerun the CEICW wizard which will specify e-mail attachments to be removed from incoming Internet e-mail. ... it should not be Exchange server issue but more related to your ISP or installed firewall or anti-spam software etc. ...
      (microsoft.public.windows.server.sbs)
    • RE: [fw-wiz] NTLM authentication from DMZ
      ... > Of Frank Knobbe ... that the OWA box needs to be in the same domain as the Exchange server ... Are you saying that you can block nb-session and have everything still ... different ports altogether. ...
      (Firewall-Wizards)
    • Re: Tdimon ?? help
      ... But, yes, Tcpview does tell you what ports are in use and who "owns" the ... geeky - but you do have to have at least a basic understanding of tcp/udp, ... One suggestion before you use these tools to troubleshoot problems is to ...
      (alt.computer.security)