Guest JDC Posted January 14, 2008 Posted January 14, 2008 My Windows 2003 web server is showing a very steady amount of action on Port 1028 and Port 135. The Process is listed as "Unknown" with a PID of 0 The Local IP is 127.0.0.1 The Remote IP is 127.0.0.1 The Remote Port is either 1028 or 135 The State is "TIME_WAIT" The Protocol is TCP Here is a screen shot: http://i52.photobucket.com/albums/g38/FFCus/1028-135.jpg The path to the executable is blank. At any given time there are at least 20 active processes of this. The virus scan says all is well. Does anybody have any suggestions as to what this is all about?
Guest Ryan Hanisco Posted January 15, 2008 Posted January 15, 2008 RE: Activity on Ports 1028 and 135 Hi JDC, Port 135 is associated with RPC and 1024-1030 are generally consumed by DCOM. You'll note that the server is talking to itself on the loopback address. This means that there isn't any traffic being routed to an external host or from an external host so there isn't something going on the order of an interception or the like. In a case like this, it could be an application making calls to other apps or modules on itself. I don't think this is really an issue and there should be little impact to the server or network infrastructure. You could try filtering that traffic, but those are common services and doing so might cause you to lose functionality. -- Ryan Hanisco MCSE, MCTS: SQL 2005, Project+ http://www.techsterity.com Chicago, IL Remember: Marking helpful answers helps everyone find the info they need quickly. "JDC" wrote: > My Windows 2003 web server is showing a very steady amount of action on Port > 1028 and Port 135. > > The Process is listed as "Unknown" with a PID of 0 > The Local IP is 127.0.0.1 > The Remote IP is 127.0.0.1 > The Remote Port is either 1028 or 135 > The State is "TIME_WAIT" > The Protocol is TCP > > Here is a screen shot: > http://i52.photobucket.com/albums/g38/FFCus/1028-135.jpg > > The path to the executable is blank. At any given time there are at least 20 > active processes of this. The virus scan says all is well. > > Does anybody have any suggestions as to what this is all about? > > >
Recommended Posts