Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Attention: The Community will be in read-only mode on 12/14/2017 from 12:00 am pacific to 11:30 am.

During this time you will only be able to see content. Other interactions such as posting, replying to questions, or marking content as helpful will be disabled for few hours.

We apologize for the inconvenience while we perform important updates to the Community.

New Member

Odd traffic

In my syslogs I am seeing a lot of traffic with the source and destination ports the same:

some.domain.net tcp/135 -> my.domain.com tcp/135

some.domain.net tcp/139 -> my.domain.com tcp/139

Any ideas?

2 REPLIES

Re: Odd traffic

Hi,

This is fairly common for Microsoft protocols. Both examples you included above are MS specific protocols (Netbios related). I *think* both of these ports were used in one of the later internet worms (Blaster, etc...). Nothing to be concerned about in most cases.

Scott

New Member

Re: Odd traffic

Thanks for the reply. What I don't understand, is why would the source port be 135? Aren't source ports supposed to start at 1024 and higher?

107
Views
0
Helpful
2
Replies
CreatePlease to create content