Re: Netbios NS



You could try installing port reporter on it to track it's port usage. On a
domain controller you do not want to leave that running longer than
necessary as it will record a lot. It can help by tracking what process is
initiating that port activity. You also could try using TCPView from
SysInternals/Microsoft to look for the same activity in real time to try and
determine the initiating process. Interesting in that the network address
you specify is what a Windows computer would assign itself via APIPA when a
DHCP server can not be located. If you find that svchost.exe is the
executable related to the process you can use tasklist /svc to see what
services are using a PID of svchost.exe.

Steve

http://support.microsoft.com/kb/837243 --- Port Reporter info
http://www.webopedia.com/TERM/A/APIPA.html -- APIPA
http://www.sysinternals.com/Utilities/TcpView.html --- TCPView


"Pete" <Pete@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:6D8E78CE-197C-4AF8-93BE-9496AEB050B9@xxxxxxxxxxxxxxxx
Hello All,
I have win2003 server running as a domain controller. I was informed by
the
security Engineer that the server is trying scan ip address at port
137-139.
This ip address are not part of our network.

I ran the Network Monitor on the server & I am only seeing that its trying
to go out to 169.254. x.x add. Not the other add that the security
engineer
had pointed out.

He even sent me the log from his scan on the firewall. It clearly shows
other ip address.

I updated the server with latest def & ran the virus scan, nothing was
found. Can some shed light on this problem.


Thanks in advance for reading/replying to this post......





.



Relevant Pages

  • RE: Some technical errors
    ... If the SMTP server is not running on port 25 TCP it is not a public ... Manager - Computer Assurance Services BDO Chartered Accountants & ...
    (Security-Basics)
  • Re: Managing "capabilities" for security
    ... default tickets are held by the kernel and can be chosen by the parent ... The default ticket for any particular call is assumed unless the ... than to check that the server address on the ticket is good. ... the kernel had to invoke the RPC if the service port IN YOUR ...
    (comp.arch.embedded)
  • Re: SRV RRs support in Internet Explorer?
    ... The port number could be implicit (i.e. ... At any point in time, a server could fail ... can't effectively LB or backup because NSs cache the records for the TTL ... I still don't see how SRV records would help backup or LB. ...
    (microsoft.public.win2000.dns)
  • Re: Creating an external trust using only LDAPS
    ... Restricting Active Directory Replication Traffic to a Specific Port ... A List of the Windows Server Domain Controller Default Ports ... With or without the domain controller certificates installed all LDAP ...
    (microsoft.public.windows.server.active_directory)
  • Re: Still cant connect to RWW or OWA remotely
    ... I get 'cannot find server or dns error' on both ... TCP [port number]> to open the ports. ... As for error messages when I fail to access RWW with the laptop, ... network, no connection seems possible. ...
    (microsoft.public.windows.server.sbs)