Wireshark sniffing “microsoft-ds [syn] seq=0..”

Question

I'm new to wireshark. (installed it today)

I'm just looking at the traffic and noticed this kind of packages:
60261 microsoft-ds [syn] seq=0 Win=8192 Len=0 MSS=1460 SACK_PERM=1
its sent to ip: 132.72.136.31 port: 445

I tried googling the line (and parts of it) and the it address - wasn't a great help. anybody knows what that is?

Answer 1

SYN means that a connection is attempted, the DS in microsoft-ds stands for directory services, but actually this port is used for SMB over TCP, which is Windows file sharing or printin (or SAMBA on Unix/Linux). It uses port 445.

If you see a lot of packets like this coming from your machine without you sharing any files it my be an indication of a virus or worm.

SAMBA/Windows file sharing should only be used on LAN addresses (commonly 192.168.0.0/16) as it is not intended for Internet use and there have been many security vulnerabilities in the implementation.