Our client has a Isilon (used only for smb) with few nodes attached to it. When I run TCPView I don't understand why svchost service established the connection and why there're so many of them:

enter image description here

And the ip

enter image description here

I run svchost analyzer to see what is the exact service behind and the result is:

Then when I connect to the other client's server with the same OS Win2012R2 and Isilon I don't see these connections. Can somebody tell if there's something wrong? Why there're so many established connections by svchost to Isilon?

enter image description here


You can tell that it's RPC traffic because of the connections to the RPC endpoint mapper on TCP port 135 and subsequent connections to a high-numbered port, e.g. 48471.

You can use portqry and query the RPC endpoint mapper on the remote device yourself, and see what RPC endpoint is registered on port 48471. My guess is that it's going to be something SAM-R related, for example to do username/group membership lookups.

This should also be apparent in a network trace. (Netmon, Wireshark, netsh.exe)

  • 1
    Thanks. Using your guides I found out that is RPC for Isilon Witness Service. – Okrx May 17 '18 at 13:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.