Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Recently, I noticed traffic from the office network to TCP port 445 on the Internet [a]. Below are the Linux firewall log entries to Facebook's network [b] and Google's network [c]. I would like to identify the source of this traffic. My first guess is that Facebook and Google might be using multiple TCP ports for SSL load balancing. However, I could not confirm this based on the web proxy logs. What else might it be?

[a] http://support.microsoft.com/kb/204279

[b] Sep 4 08:30:03 firewall01 kernel: IN=eth0 OUT=eth2 SRC=10.0.0.131 DST=69.171.237.34 LEN=52 TOS=0x00 PREC=0x00 TTL=127 ID=14287 DF PROTO=TCP SPT=51711 DPT=445 WINDOW=8192 RES=0x00 SYN URGP=0

[c] Aug 28 06:02:41 firewall01 kernel: IN=eth0 OUT=eth2 SRC=10.0.0.115 DST=173.194.33.47 LEN=52 TOS=0x00 PREC=0x00 TTL=127 ID=4558 DF PROTO=TCP SPT=49294 DPT=445 WINDOW=8192 RES=0x00 SYN URGP=0

share|improve this question

It's a very wild guess, but maybe some program is mistakenly trying to access \\www.google.com\path instead of http://www.google.com/path?

  1. Some websites use scheme-relative URIs such as //host/path instead of http://host/path. (This is an easy way to make the same link work over both HTTP and HTTPS.)

  2. Some programs might incorrectly interpret such a relative URI (//host/path) as an UNC address (\\host\path).

  3. When a program opens an UNC path, Windows tries to access it using SMB (both direct and over NetBIOS) and HTTP/WebDAV.

share|improve this answer
    
Some program or some user, though most I've seen replace the backslash (\`) with a forward slash (/`), not the other way around. – afrazier Sep 4 '12 at 20:25
    
@afrazier: I have seen a few users typing http:\\www.example.com\path\path\path... – grawity Sep 4 '12 at 21:16
    
I have seen poorly coded Flash and HTML documents that refer to UNC paths, but have never yet caught them on Facebook or Google. Every browser I tested accepts http:\\example.com\path and //example.com/path. When I try \\example.com\path in Internet Explorer, Windows attempts to connect to TCP port 445. However, it generates more log entries than the "mystery traffic" observed earlier. – Ben Collver Sep 4 '12 at 21:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .