Port 139/445 traffic to non-existent IP?

[iLinkTech]

Hi,

Was asked to look at syslog data for a previous client's W2K3 domain as part of a random secuirty audit (doing a favor for a friend). In his syslog I noticed something odd; one of his W2K3 SP1 file servers was intermittantly trying to communicate over ports 139/445 with the IP segment of his DMZ.

Strange thing is that the specific destination IP address does not and has never existed on his DMZ. The packet size varies but is typically around 144 bytes. Even stranger (maybe) is that even though this IP does not exist, packets with a size of 228 bytes are being returned to the file server.

Thinking that this box is in trouble, I've helped him run a number of tests, scans, etc. AV comes up clean (including heuristics and ADS), RootkitRevealer was unremarkable, spyware scanning w/ Windows Defender was unremarkable as well. The connection attempts are not consistent other than when they happen they tend to happen in pairs at 3 hour intervals; first over 139 and then over 445.

I won't pretend to know what's happening with this but if anyone has any ideas....

Thanks - it's always over the holidays...

 

[tfg13]

You may have already looked at this:

http://www.petri.co.il/what's_port_445_in_w2k_xp_2003.htm

Anyway, would there be any harm in running a packet sniffer? You should be able to do this on the server, and inspect what is actually being sent to the other IP, and what is being sent back.

I'm wondering if there is something "caught" if you will, in the network scheme. Has there ever been a printer, or a file server in the network. Not necessarily with that IP, but maybe with a name. Port 445 and 139 are for file/print sharing over NetBIOS over TCP. Anything in the host file?

 

[porkchopexpress]

What services are running in the DMZ?

 

[iLinkTech]

Thanks tfg13 - I have seen that doc before.

As far as something "caught" - I don't know what else he might have played with in the past - I'm going out to his site tonight and will run a sniffer to see if there is anything really of interest going on. The only thing that he currently has running in the DMZ is a SMTP relay / SPAM scanner.

Thanks...will advise if it's interesting