We've got a Windows Server 2008 R2 instance running IIS 7 serving multiple websites / web services on multiple domains (all port 80 or 443).
We have a security issue with a specific subdomain/port, and I would like to configure the server not to respond on that subdomain/port combination at all (i.e., not even a TCP response...the
SYN should receive no corresponding
ACK, as if the server doesn't even exist).
I'm not an experienced network admin, and less so on Windows. Using Microsoft Network Monitor, I can see that something is picking up the phone and responding with a 404:
The "process" field is blank, so I don't know what's actually picking up the phone. I suspect it must be IIS, but there's no website configured to respond to this particular domain/port. I thought perhaps the "Default Web Site" catches all unconfigured traffic, but when I set up failed request monitoring on the Default Web Site, I get no logs for it.
I suppose a firewall entry might do the job, but I would like to know how things actually work before going that route. What is responding to this network request, and how do I find out? And then can I configure that component to not respond to these requests?
UPDATE: per @Mass Nerder's comment, I ran
netstat -anb and I get the following for port 80 (the port in question):
TCP 0.0.0.0:80 0.0.0.0:0 LISTENING Can not obtain ownership information TCP 172.17.63.2:80 18.104.22.168:37961 ESTABLISHED Can not obtain ownership information TCP 172.17.63.2:80 22.214.171.124:54097 ESTABLISHED Can not obtain ownership information TCP 172.17.63.4:80 126.96.36.199:53898 ESTABLISHED Can not obtain ownership information TCP 172.17.63.4:80 188.8.131.52:53899 ESTABLISHED Can not obtain ownership information TCP 172.17.63.4:80 184.108.40.206:53900 ESTABLISHED Can not obtain ownership information TCP [::]:80 [::]:0 LISTENING Can not obtain ownership information