Networks

Ask something
Question Locked

epmap

0 helpful
6 replies

by clarkd038

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I have one computer on our network that is connecting to our remote DC through the epmap protocol, and also 2 more servers on the same protocol using port 135.

I have googled this and found nothing worth while.

If anybody has any suggestions it would be greatly appreciated.

6 replies

by wizard-09

http://www.iss.net/security_center/advice/Exploits/Ports/135/default.htm

Microsoft DCE Locator service aka. end-point mapper. It works like Sun RPC portmapper, except that end-points can also be named pipes. Microsoft relies upon DCE RPC to remotely manage services. Some services that use port 135 of end-point mapping are:
DHCP server
DNS server
WINS server

by clarkd038

Thanks for the reply, I see that the port could also be used for remote access, but what is bothering me is why is only 1 of our workstations reaching out through this port.

The virus scan came back negative as I also read it could be a worm.

If you have any more information it would be greatly appreciated.

by wizard-09

Download Wire Shark onto the machine in question run it and it will provide you with more information on the network traffic of that port and other ports being used, you will then for sure see whats going on and should no what to do from there.

google wire shark

This port is only used for end mapping and piping so you should not really worry about it it might only be on this machine because of some software that is not on the other machines so a thought

by clarkd038

I already have wireshark I don't know why I didn't think of that.

Thanks again

by wizard-09

As i said it might be down to some software on the machine, let me know how you get on be interested to see what it was :D

This discussion is closed to new replies.