Activity on Ports 1028 and 135

[Guest JDC]

My Windows 2003 web server is showing a very steady amount of action on Port

1028 and Port 135.

 

The Process is listed as "Unknown" with a PID of 0

The Local IP is 127.0.0.1

The Remote IP is 127.0.0.1

The Remote Port is either 1028 or 135

The State is "TIME_WAIT"

The Protocol is TCP

 

Here is a screen shot:

http://i52.photobucket.com/albums/g38/FFCus/1028-135.jpg

 

The path to the executable is blank. At any given time there are at least 20

active processes of this. The virus scan says all is well.

 

Does anybody have any suggestions as to what this is all about?

[Guest Ryan Hanisco]

RE: Activity on Ports 1028 and 135

 

Hi JDC,

 

Port 135 is associated with RPC and 1024-1030 are generally consumed by

DCOM. You'll note that the server is talking to itself on the loopback

address. This means that there isn't any traffic being routed to an external

host or from an external host so there isn't something going on the order of

an interception or the like.

 

In a case like this, it could be an application making calls to other apps

or modules on itself. I don't think this is really an issue and there should

be little impact to the server or network infrastructure. You could try

filtering that traffic, but those are common services and doing so might

cause you to lose functionality.

--

Ryan Hanisco

MCSE, MCTS: SQL 2005, Project+

http://www.techsterity.com

Chicago, IL

 

Remember: Marking helpful answers helps everyone find the info they need

quickly.

 

 

"JDC" wrote:

> My Windows 2003 web server is showing a very steady amount of action on Port

> 1028 and Port 135.

>

> The Process is listed as "Unknown" with a PID of 0

> The Local IP is 127.0.0.1

> The Remote IP is 127.0.0.1

> The Remote Port is either 1028 or 135

> The State is "TIME_WAIT"

> The Protocol is TCP

>

> Here is a screen shot:

> http://i52.photobucket.com/albums/g38/FFCus/1028-135.jpg

>

> The path to the executable is blank. At any given time there are at least 20

> active processes of this. The virus scan says all is well.

>

> Does anybody have any suggestions as to what this is all about?

>

>

>