Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm new to wireshark. (installed it today)

I'm just looking at the traffic and noticed this kind of packages:
60261 microsoft-ds [syn] seq=0 Win=8192 Len=0 MSS=1460 SACK_PERM=1
its sent to ip: 132.72.136.31 port: 445

I tried googling the line (and parts of it) and the it address - wasn't a great help. anybody knows what that is?

share|improve this question
add comment

migrated from stackoverflow.com Oct 17 '11 at 17:32

This question came from our site for professional and enthusiast programmers.

1 Answer

up vote 1 down vote accepted

SYN means that a connection is attempted, the DS in microsoft-ds stands for directory services, but actually this port is used for SMB over TCP, which is Windows file sharing or printin (or SAMBA on Unix/Linux). It uses port 445.

If you see a lot of packets like this coming from your machine without you sharing any files it my be an indication of a virus or worm.

SAMBA/Windows file sharing should only be used on LAN addresses (commonly 192.168.0.0/16) as it is not intended for Internet use and there have been many security vulnerabilities in the implementation.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.