Handler on Duty: Johannes Ullrich
Threat Level: green
Loading...
|
|
||||||||||||||||||||||||||||||||||
| Submitted By | Date |
|---|---|
| Comment | |
| Rick Guthrie, CISSP | 2004-09-15 16:51:22 |
| An nmap scan of a newly built Windows Server 2003 machine as the first domain controller in a new forest showed port 1050 open. Of course there were other ports open, but the ones that were not correctly identified are 1025, 1026, and 1050. 1025 and 1026 are for AD logon and replication, as per a Microsoft article. Using netstat with the -ano option showed that port 1050 was assigned PID 1432. Using the Task Manger, it show that that process was being used by Image name dns.exe After a restart, the PID changed to 1400, but continued to be used used by dns.exe I found a Microsoft Knowledge Base Article that suggest that this is an arbitrary port chosen by DNS to allow DNS lookups to occure to the Internet when interesting port are being blocked by a Firewall. The article is number: 198410, look for the registry key "SendOnNonDnsPort". Hope this helps! | |
| CVE # | Description |
|---|
© 2024 SANS™ Internet Storm Center
Developers: We have an API for you! 