System Process Listening on thousands of ports

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

I've got a Win2K DC which has started acting real funny.

Firtsly I noticed the Novell client would not accept my username and
password but I could validate myself as a windows user. This is because it
can't start UNC pathnames to other boxes or browse the network, but being a
dc could validate me internally as a windows user.
eventually after many 8032 and 8021 errors in the system log i found
http://support.microsoft.com/?kbid=319504
To be very descriptive of the situation I have.
Problem being , the process creating all the connections and exceeding my
'limit' is the System process (PID 8). I have no idea why it's creating so
many listening ports and wondered if anyone here had any idea how to help me
trouble shoot this?
The System process has created a listening instance on every port from 1026
to 5000 . The box is fully service packed and hotfixed.
HELP?

Paul.
 
Yes it's been scanned for Viruses and adware.

Thanks

Richard G. Harper said:
Yeah, but has it been scanned for viruses, adware or spyware?

--
Richard G. Harper [MVP Shell/User] (e-mail address removed)
* PLEASE post all messages and replies in the newsgroups
* for the benefit of all. Private mail is usually not replied to.
* My website, such as it is ... http://rgharper.mvps.org/
* HELP us help YOU ... http://www.dts-l.org/goodpost.htm


Paul_WWF said:
I've got a Win2K DC which has started acting real funny.

Firtsly I noticed the Novell client would not accept my username and
password but I could validate myself as a windows user. This is because it
can't start UNC pathnames to other boxes or browse the network, but being
a
dc could validate me internally as a windows user.
eventually after many 8032 and 8021 errors in the system log i found
http://support.microsoft.com/?kbid=319504
To be very descriptive of the situation I have.
Problem being , the process creating all the connections and exceeding my
'limit' is the System process (PID 8). I have no idea why it's creating so
many listening ports and wondered if anyone here had any idea how to help
me
trouble shoot this?
The System process has created a listening instance on every port from
1026
to 5000 . The box is fully service packed and hotfixed.
HELP?

Paul.
Click to expand...
Click to expand...
 
I've solved this problem or at least found whats responsible for all the
connections!

It's the HP Compaq Management software creating never ending connections ..
I've upgraded to 7.30 and will wait and see how it performs. At least I know
what the problem is now. I was getting so frustrated!

Paul.

Paul_WWF said:
Yes it's been scanned for Viruses and adware.

Thanks

Richard G. Harper said:
Yeah, but has it been scanned for viruses, adware or spyware?

--
Richard G. Harper [MVP Shell/User] (e-mail address removed)
* PLEASE post all messages and replies in the newsgroups
* for the benefit of all. Private mail is usually not replied to.
* My website, such as it is ... http://rgharper.mvps.org/
* HELP us help YOU ... http://www.dts-l.org/goodpost.htm


Paul_WWF said:
I've got a Win2K DC which has started acting real funny.

Firtsly I noticed the Novell client would not accept my username and
password but I could validate myself as a windows user. This is because it
can't start UNC pathnames to other boxes or browse the network, but being
a
dc could validate me internally as a windows user.
eventually after many 8032 and 8021 errors in the system log i found
http://support.microsoft.com/?kbid=319504
To be very descriptive of the situation I have.
Problem being , the process creating all the connections and exceeding my
'limit' is the System process (PID 8). I have no idea why it's creating so
many listening ports and wondered if anyone here had any idea how to help
me
trouble shoot this?
The System process has created a listening instance on every port from
1026
to 5000 . The box is fully service packed and hotfixed.
HELP?

Paul.
Click to expand...
Click to expand...
Click to expand...
 
Excellent news - glad you stuck it out until you found the cause.

--
Richard G. Harper [MVP Shell/User] (e-mail address removed)
* PLEASE post all messages and replies in the newsgroups
* for the benefit of all. Private mail is usually not replied to.
* My website, such as it is ... http://rgharper.mvps.org/
* HELP us help YOU ... http://www.dts-l.org/goodpost.htm


Paul_WWF said:
I've solved this problem or at least found whats responsible for all the
connections!

It's the HP Compaq Management software creating never ending connections
..
I've upgraded to 7.30 and will wait and see how it performs. At least I
know
what the problem is now. I was getting so frustrated!

Paul.

Paul_WWF said:
Yes it's been scanned for Viruses and adware.

Thanks

Richard G. Harper said:
Yeah, but has it been scanned for viruses, adware or spyware?

--
Richard G. Harper [MVP Shell/User] (e-mail address removed)
* PLEASE post all messages and replies in the newsgroups
* for the benefit of all. Private mail is usually not replied to.
* My website, such as it is ... http://rgharper.mvps.org/
* HELP us help YOU ... http://www.dts-l.org/goodpost.htm


I've got a Win2K DC which has started acting real funny.

Firtsly I noticed the Novell client would not accept my username and
password but I could validate myself as a windows user. This is
because it
can't start UNC pathnames to other boxes or browse the network, but
being
a
dc could validate me internally as a windows user.
eventually after many 8032 and 8021 errors in the system log i found
http://support.microsoft.com/?kbid=319504
To be very descriptive of the situation I have.
Problem being , the process creating all the connections and
exceeding my
'limit' is the System process (PID 8). I have no idea why it's
creating so
many listening ports and wondered if anyone here had any idea how to
help
me
trouble shoot this?
The System process has created a listening instance on every port
from
1026
to 5000 . The box is fully service packed and hotfixed.
HELP?

Paul.
Click to expand...
Click to expand...
Click to expand...
 
Hmm , perhaps not.
The Compaq Management software was responsible for alot of the connections
but not anywhere near ALL of them.

This is a TCPView dump of the server in action -
http://www.daxb.demon.co.uk/process.txt

See all the System:8's and how many there are!?

Don't worry about the RouterNT.exe , thats Sophos Enterprise doing it's
usual hogging of resource.

http://www.daxb.demon.co.uk/uk_hr.xls
is a spreadsheet of the installed software on the server - please note -
this is not accurate in that it's actually WIN2K SP4 with ALL hotfixes. All
the 3rd Party software is as is.

Any help towards fixing this would be great. I'm VERY reluctant to extend
the ephemeral range available to the machine as there is nothing installed
that needs it and this is INCORRECT behaviour.

Please help!

Paul.

Richard G. Harper said:
Excellent news - glad you stuck it out until you found the cause.

--
Richard G. Harper [MVP Shell/User] (e-mail address removed)
* PLEASE post all messages and replies in the newsgroups
* for the benefit of all. Private mail is usually not replied to.
* My website, such as it is ... http://rgharper.mvps.org/
* HELP us help YOU ... http://www.dts-l.org/goodpost.htm


Paul_WWF said:
I've solved this problem or at least found whats responsible for all the
connections!

It's the HP Compaq Management software creating never ending connections
..
I've upgraded to 7.30 and will wait and see how it performs. At least I
know
what the problem is now. I was getting so frustrated!

Paul.

Paul_WWF said:
Yes it's been scanned for Viruses and adware.

Thanks

:

Yeah, but has it been scanned for viruses, adware or spyware?

--
Richard G. Harper [MVP Shell/User] (e-mail address removed)
* PLEASE post all messages and replies in the newsgroups
* for the benefit of all. Private mail is usually not replied to.
* My website, such as it is ... http://rgharper.mvps.org/
* HELP us help YOU ... http://www.dts-l.org/goodpost.htm


I've got a Win2K DC which has started acting real funny.

Firtsly I noticed the Novell client would not accept my username and
password but I could validate myself as a windows user. This is
because it
can't start UNC pathnames to other boxes or browse the network, but
being
a
dc could validate me internally as a windows user.
eventually after many 8032 and 8021 errors in the system log i found
http://support.microsoft.com/?kbid=319504
To be very descriptive of the situation I have.
Problem being , the process creating all the connections and
exceeding my
'limit' is the System process (PID 8). I have no idea why it's
creating so
many listening ports and wondered if anyone here had any idea how to
help
me
trouble shoot this?
The System process has created a listening instance on every port
from
1026
to 5000 . The box is fully service packed and hotfixed.
HELP?

Paul.
Click to expand...
Click to expand...
Click to expand...
 
Back
Top