1

We've got a Windows Server 2008 R2 instance running IIS 7 serving multiple websites / web services on multiple domains (all port 80 or 443).

We have a security issue with a specific subdomain/port, and I would like to configure the server not to respond on that subdomain/port combination at all (i.e., not even a TCP response...the SYN should receive no corresponding ACK, as if the server doesn't even exist).

I'm not an experienced network admin, and less so on Windows. Using Microsoft Network Monitor, I can see that something is picking up the phone and responding with a 404:

enter image description here

The "process" field is blank, so I don't know what's actually picking up the phone. I suspect it must be IIS, but there's no website configured to respond to this particular domain/port. I thought perhaps the "Default Web Site" catches all unconfigured traffic, but when I set up failed request monitoring on the Default Web Site, I get no logs for it.

I suppose a firewall entry might do the job, but I would like to know how things actually work before going that route. What is responding to this network request, and how do I find out? And then can I configure that component to not respond to these requests?

UPDATE: per @Mass Nerder's comment, I ran netstat -anb and I get the following for port 80 (the port in question):

  TCP    0.0.0.0:80             0.0.0.0:0              LISTENING
 Can not obtain ownership information
  TCP    172.17.63.2:80         50.205.86.154:37961    ESTABLISHED
 Can not obtain ownership information
  TCP    172.17.63.2:80         50.205.86.154:54097    ESTABLISHED
 Can not obtain ownership information
  TCP    172.17.63.4:80         69.66.192.88:53898     ESTABLISHED
 Can not obtain ownership information
  TCP    172.17.63.4:80         69.66.192.88:53899     ESTABLISHED
 Can not obtain ownership information
  TCP    172.17.63.4:80         69.66.192.88:53900     ESTABLISHED
 Can not obtain ownership information
  TCP    [::]:80                [::]:0                 LISTENING
 Can not obtain ownership information
  • run netstat -anb to see what is listening on that port – Mass Nerder Oct 13 '16 at 18:25
  • Updated with netstat -anb results – Ethan Brown Oct 13 '16 at 18:32
  • Since the -b didn't give the owner information try netstat -ano which will hopefully give you the PID of the process and then you can use task manager to make that PID to the process name – Mass Nerder Oct 13 '16 at 18:38
  • I'm assuming the server is in the DMZ or on the net directly otherwise you could filter on the actual firewall. Without a Destination I can't tell what you are trying to block. Is it IP:80 traffic? You're request of "not even a TCP response" would mean you would have to not have the port open on that IP at all, otherwise IIS will reply back. If you are hosting multiple domains on the same IP:port combo then this isn't an option though. So can you elaborate what "destination" you are trying to prevent responding? – TheCleaner Oct 13 '16 at 18:39
  • @TheCleaner, I think you answered my question...other apps do need to respond on port 80 (via different domains/subdomains). So it sounds like what I'm looking to do isn't possible. – Ethan Brown Oct 13 '16 at 20:05
1

I'm assuming the server is in the DMZ or on the net directly otherwise you could filter on the actual firewall. Without a Destination I can't tell what you are trying to block. Is it IP:80 traffic? You're request of "not even a TCP response" would mean you would have to not have the port open on that IP at all, otherwise IIS will reply back.

f you are hosting multiple domains on the same IP:port combo then this isn't an option though.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.