My firewall is logging TCP SYN ACK activity from the domain controller that is constant. I have pasted a sample of the log below. It doesn’t do every port but seems to start at 1096 go through some not all of the ports to 4976 then restarts with 1096. There are a couple of instances of activity attempts to 29054.
IP: discard from 10.67.10.30 port 139 to 169.254.4.124 port 1925 TCP SYN ACK (Attempt to send TCP packet on an unopen port)
IP: discard from 10.67.10.30 port 139 to 169.254.4.124 port 1817 TCP SYN ACK (Attempt to send TCP packet on an unopen port)
IP: discard from 10.67.10.30 port 139 to 169.254.4.124 port 1925 TCP SYN ACK (Attempt to send TCP packet on an unopen port)
The Domain Controller is part of AD and runs, DHCP, DNS and WINS. Before anyone guesses it is WINS causing the activity, WINS has been running for a long time without causing this.
Anyone have any idea what is going on and how I can stop this DC behavior?
Thanks,
Jeanette Hartwick
IS Manager