1

I have a Windows Server 2012 that every few seconds sends packets destined for port 445 on local IPs on other subnets. The IPs on other subnets it is trying to reach are devices such as VoIP phones, for example. I understand port 445 is related to Samba and/or File Replication Service and of course a VoIP phone should have no interest in services like these. I can see the traffic because our firewall sitting at the 'head' of the VLAN subnets is rightly dropping the packets.

I am wondering what causes the Windows Server OS to 'get wind' of the existence of these IP addresses and therefore decide to consistently spam them on port 445. From this, I then hope to stop this happening as it is filling up my firewall logs with noise.

The server in question is a domain controller, and the first in the domain (I know PDC is a deprecated term now). Perhaps this is relevant.

  • How does the Windows OS learn of these IP addresses on the network? Logically they have no reason to interact cross subnet, except the occasional DNS lookup from the VoIP devices.
  • How can I find out which process or service is polling/spamming/trying to lookup the devices?
  • And, how might I disable the Windows OS from doing this, or otherwise 'remove' the non-domain member device from it's repository of said things to 'spam'.
3
  • Do the VoIP phones cross subnets to obtain their configs from a share or TFTP server, perhaps on the same subnet as your server?
    – armani
    Mar 3, 2015 at 19:30
  • @armani No they don't. They retrieve information from a Internet based provisioning server and connect to an Internet based SIP server. The only interaction they have with the "clean" subnet is DNS and NTP lookups.
    – George
    Mar 4, 2015 at 10:06
  • Sorry! I know this is a really old thread but did you ever figure this out? I have seen this multiple times and never identified the root cause. Searching the forums does not generally return relevant questions. Thank you ~Jon
    – Jon S
    Aug 1, 2018 at 12:05

2 Answers 2

1

The OP indicated that it was searching across networks that the server should have no knowledge of. The SMB File Sharing Discovery should only be doing discovery on local connected networks and we would not see them in the firewall logs.

For future info, I have resolved our issue and it was due to the firewall. It uses single sign on. When a user attempts internet access from the other networks, be it guest or VoIP, the firewall tries to determine the user by querying the server, which then queries the client device on 445. If the client device is on a different subnet, we will see these denied packets.

This is a really old post but maybe helpful to others as it initially went unanswered for over 3 years.

~Jon

0

It is exactly as you describe, SMB file sharing discovery, and it uses the credentials from the domain controller to search for shares. If you're not using SMB it can be disabled by turning off the service on the Windows server or you can filter your logs in the firewall.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .