Unknown port usage on Windows 2000 Server

[downhill360]

Hello all....

I have two domain controllers running Windows 2000 Server. I am trying to find out why they keep sending packets to a server in the DMZ. Our firewall logs show several thousand transmissions being blocked from the inside of our network every several hours on ports 1027, 1028, 1029, 2356, 37518, and 50736. These transmissions are originating from the two domain controllers.

If anyone has ever seen this or anything like, I would appreciate the help.

Thanks
Jim

 

[MasterofNone]

You might want to dump this information to a text file, but on the domain controller try
netstat -vb
or netstat -vb >textfile.txt

This might take a while as it reports on each open connection. then at least you will know which process is making these connections

how's your virus definitions, as the last couple are used by messenger services (TCP Port definitions), but a number of sources suggest that can be used by a virus or trojan attack. Happy hunting