2

Our client has a Isilon (used only for smb) with few nodes attached to it. When I run TCPView I don't understand why svchost service established the connection and why there're so many of them:

enter image description here

And the ip 10.64.4.212:

enter image description here

I run svchost analyzer to see what is the exact service behind and the result is:

Then when I connect to the other client's server with the same OS Win2012R2 and Isilon I don't see these connections. Can somebody tell if there's something wrong? Why there're so many established connections by svchost to Isilon?

enter image description here

Improve this question

1 Answer 1

Reset to default
3

You can tell that it's RPC traffic because of the connections to the RPC endpoint mapper on TCP port 135 and subsequent connections to a high-numbered port, e.g. 48471.

You can use portqry and query the RPC endpoint mapper on the remote device yourself, and see what RPC endpoint is registered on port 48471. My guess is that it's going to be something SAM-R related, for example to do username/group membership lookups.

This should also be apparent in a network trace. (Netmon, Wireshark, netsh.exe)

Improve this answer
1
  • 1
    Thanks. Using your guides I found out that is RPC for Isilon Witness Service.
    – Okrx
    May 17, 2018 at 13:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .