Strange Port 135 problem

[amb3rsil]

Hello,

Just started my first job as an ICT Technician, so please dont get annoyed if this is a stupid question or I have got confused!!

Basically I have come across a problem in that our router which receives its connection through dual isdn from our isp keeps dialling out on average every 5 minutes when there is nobody in the building and nobody logged on. I discussed this with our ISP and they informed me after looking on the router logs that the IP 172.16.1.1 on port 135 was attempted to be connected to and that it was something to do with WINS. So I disabled WINS but to no avail and I have checked whilst running netstat that sure enough every little while the following comes up :-

Remote address 172.16.1.1
local port 2886
remote port 135
protocol TCP
Status SYN_SENT

Then it just disappears. Im really confused as to what this is and if fact there is any relation to it and the router constantly dialling out and making our phone bills expensive. Any ideas?

TIA

Regards,

Amb3rsil

 

[DevilDog]

You did not say how your WAN was configured; is your ISDN part of your WAN or just a link to the WEB. Your problem raised the small hairs on the back of my neck... we had an identical problem about 4 years ago. This may be a long shot but take a look at this article support.microsoft.com/support/kb/articles/Q150/3/50.asp
Let me know how close this comes to your problem. -- Devil Dog --

 

[amb3rsil]

Hmm..well all the router does is route through to our service provider so Im assuming its just our link to the web. Thanks for pointing me towards the article in the kb, however I decided on a robust solution, which was on talking to allied telesyn (router manufacturers) I telneted into the router and applied ip filtering. Just in case any one else has this problem the command for it was :-

add ip filter=1 so=0.0.0.0 ac=exclude prot=tcp dp=135
(then enter)
set ip int=eth0 fil=1

Im guessing the syntax is specific to my router but Im sure most routers have ip filtering options so it should help anyone with a similar problem...

I just hope there arent any repurcussions from bloking the port entirely...anyone?

Thanks for your help again DD

Regards, Amb3rsil

 

[Highland]

Only thing I've seen similar was remote printers polling centrally defined Qs across ISDN, every 10 minutes or so they would activate the link....!!!!