1

Recently, I noticed traffic from the office network to TCP port 445 on the Internet [a]. Below are the Linux firewall log entries to Facebook's network [b] and Google's network [c]. I would like to identify the source of this traffic. My first guess is that Facebook and Google might be using multiple TCP ports for SSL load balancing. However, I could not confirm this based on the web proxy logs. What else might it be?

[a] http://support.microsoft.com/kb/204279

[b]
Sep 4 08:30:03 firewall01 kernel: IN=eth0 OUT=eth2 SRC=10.0.0.131 DST=69.171.237.34 LEN=52 TOS=0x00 PREC=0x00 TTL=127 ID=14287 DF PROTO=TCP SPT=51711 DPT=445 WINDOW=8192 RES=0x00 SYN URGP=0

[c]
Aug 28 06:02:41 firewall01 kernel: IN=eth0 OUT=eth2 SRC=10.0.0.115 DST=173.194.33.47 LEN=52 TOS=0x00 PREC=0x00 TTL=127 ID=4558 DF PROTO=TCP SPT=49294 DPT=445 WINDOW=8192 RES=0x00 SYN URGP=0
Improve this question

1 Answer 1

Reset to default
2

It's a very wild guess, but maybe some program is mistakenly trying to access \\www.google.com\path instead of http://www.google.com/path?

  1. Some websites use scheme-relative URIs such as //host/path instead of http://host/path. (This is an easy way to make the same link work over both HTTP and HTTPS.)

  2. Some programs might incorrectly interpret such a relative URI (//host/path) as an UNC address (\\host\path).

  3. When a program opens an UNC path, Windows tries to access it using SMB (both direct and over NetBIOS) and HTTP/WebDAV.

Improve this answer
3
  • Some program or some user, though most I've seen replace the backslash (\`) with a forward slash (/`), not the other way around.
    – afrazier
    Sep 4, 2012 at 20:25
  • @afrazier: I have seen a few users typing http:\\www.example.com\path\path\path...
    – u1686_grawity
    Sep 4, 2012 at 21:16
  • I have seen poorly coded Flash and HTML documents that refer to UNC paths, but have never yet caught them on Facebook or Google. Every browser I tested accepts http:\\example.com\path and //example.com/path. When I try \\example.com\path in Internet Explorer, Windows attempts to connect to TCP port 445. However, it generates more log entries than the "mystery traffic" observed earlier.
    – Ben Collver
    Sep 4, 2012 at 21:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .