I have a Windows Server 2012 that every few seconds sends packets destined for port 445 on local IPs on other subnets. The IPs on other subnets it is trying to reach are devices such as VoIP phones, for example. I understand port 445 is related to Samba and/or File Replication Service and of course a VoIP phone should have no interest in services like these. I can see the traffic because our firewall sitting at the 'head' of the VLAN subnets is rightly dropping the packets.
I am wondering what causes the Windows Server OS to 'get wind' of the existence of these IP addresses and therefore decide to consistently spam them on port 445. From this, I then hope to stop this happening as it is filling up my firewall logs with noise.
The server in question is a domain controller, and the first in the domain (I know PDC is a deprecated term now). Perhaps this is relevant.
- How does the Windows OS learn of these IP addresses on the network? Logically they have no reason to interact cross subnet, except the occasional DNS lookup from the VoIP devices.
- How can I find out which process or service is polling/spamming/trying to lookup the devices?
- And, how might I disable the Windows OS from doing this, or otherwise 'remove' the non-domain member device from it's repository of said things to 'spam'.