Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Recently, I noticed traffic from the office network to TCP port 445 on the Internet [a]. Below are the Linux firewall log entries to Facebook's network [b] and Google's network [c]. I would like to identify the source of this traffic. My first guess is that Facebook and Google might be using multiple TCP ports for SSL load balancing. However, I could not confirm this based on the web proxy logs. What else might it be?

[a] http://support.microsoft.com/kb/204279

[b] Sep 4 08:30:03 firewall01 kernel: IN=eth0 OUT=eth2 SRC=10.0.0.131 DST=69.171.237.34 LEN=52 TOS=0x00 PREC=0x00 TTL=127 ID=14287 DF PROTO=TCP SPT=51711 DPT=445 WINDOW=8192 RES=0x00 SYN URGP=0

[c] Aug 28 06:02:41 firewall01 kernel: IN=eth0 OUT=eth2 SRC=10.0.0.115 DST=173.194.33.47 LEN=52 TOS=0x00 PREC=0x00 TTL=127 ID=4558 DF PROTO=TCP SPT=49294 DPT=445 WINDOW=8192 RES=0x00 SYN URGP=0

share|improve this question

1 Answer 1

It's a very wild guess, but maybe some program is mistakenly trying to access \\www.google.com\path instead of http://www.google.com/path?

  1. Some websites use scheme-relative URIs such as //host/path instead of http://host/path. (This is an easy way to make the same link work over both HTTP and HTTPS.)

  2. Some programs might incorrectly interpret such a relative URI (//host/path) as an UNC address (\\host\path).

  3. When a program opens an UNC path, Windows tries to access it using SMB (both direct and over NetBIOS) and HTTP/WebDAV.

share|improve this answer
    
Some program or some user, though most I've seen replace the backslash (\`) with a forward slash (/`), not the other way around. –  afrazier Sep 4 '12 at 20:25
    
@afrazier: I have seen a few users typing http:\\www.example.com\path\path\path... –  grawity Sep 4 '12 at 21:16
    
I have seen poorly coded Flash and HTML documents that refer to UNC paths, but have never yet caught them on Facebook or Google. Every browser I tested accepts http:\\example.com\path and //example.com/path. When I try \\example.com\path in Internet Explorer, Windows attempts to connect to TCP port 445. However, it generates more log entries than the "mystery traffic" observed earlier. –  Ben Collver Sep 4 '12 at 21:50

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.