Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm new to wireshark. (installed it today)

I'm just looking at the traffic and noticed this kind of packages:
60261 microsoft-ds [syn] seq=0 Win=8192 Len=0 MSS=1460 SACK_PERM=1
its sent to ip: port: 445

I tried googling the line (and parts of it) and the it address - wasn't a great help. anybody knows what that is?

share|improve this question

migrated from Oct 17 '11 at 17:32

This question came from our site for professional and enthusiast programmers.

up vote 1 down vote accepted

SYN means that a connection is attempted, the DS in microsoft-ds stands for directory services, but actually this port is used for SMB over TCP, which is Windows file sharing or printin (or SAMBA on Unix/Linux). It uses port 445.

If you see a lot of packets like this coming from your machine without you sharing any files it my be an indication of a virus or worm.

SAMBA/Windows file sharing should only be used on LAN addresses (commonly as it is not intended for Internet use and there have been many security vulnerabilities in the implementation.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.