Re: Netbios NS



You could try installing port reporter on it to track it's port usage. On a
domain controller you do not want to leave that running longer than
necessary as it will record a lot. It can help by tracking what process is
initiating that port activity. You also could try using TCPView from
SysInternals/Microsoft to look for the same activity in real time to try and
determine the initiating process. Interesting in that the network address
you specify is what a Windows computer would assign itself via APIPA when a
DHCP server can not be located. If you find that svchost.exe is the
executable related to the process you can use tasklist /svc to see what
services are using a PID of svchost.exe.

Steve

http://support.microsoft.com/kb/837243 --- Port Reporter info
http://www.webopedia.com/TERM/A/APIPA.html -- APIPA
http://www.sysinternals.com/Utilities/TcpView.html --- TCPView


"Pete" <Pete@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:6D8E78CE-197C-4AF8-93BE-9496AEB050B9@xxxxxxxxxxxxxxxx
Hello All,
I have win2003 server running as a domain controller. I was informed by
the
security Engineer that the server is trying scan ip address at port
137-139.
This ip address are not part of our network.

I ran the Network Monitor on the server & I am only seeing that its trying
to go out to 169.254. x.x add. Not the other add that the security
engineer
had pointed out.

He even sent me the log from his scan on the firewall. It clearly shows
other ip address.

I updated the server with latest def & ran the virus scan, nothing was
found. Can some shed light on this problem.


Thanks in advance for reading/replying to this post......





.