Windows 2003: Netstat results mention microsoft-ds

> Folks,
> My netstat results show a connection from microsoft-ds to a port on my
> server and another from that port to microsoft-ds. The microsoft site
> doesn't seem to have much information about it.
> Does this have any security implications?
> Also, while looking for information on port 1383 I saw that the
> description mentioned GW Hannaway Network License Manager. Is it ok to
> have this port open on a windows 2003 server?
> Thanks,
> J.S.

> Hi,
>
> What information are you looking for? Microsoft-DS TCP port is TCP port 445.
> This port is also commonly referred to as SMB or CIFS.
>
> About 1383 port. Since Windows will often dynamically assign ports to
> different services it is hard to tell what actually runs behind this port
> (which service). Once way to find out is to run following command...
>
> netstat -nb | more
>
> It will display something like this...
>
> TCP 10.10.190.74:1956 10.10.2.46:3389 ESTABLISHED 2072
> [mstsc.exe]
>
> This means that mstsc program is connecting from IP address 10.10.190.74 to
> 10.10.2.46 on TCP port 3389...
>
> After you know which service is running on this port, you can decide if you
> need it or if it can be shut down and disabled.
>

> Hi Mike,
> Thanks for your response. I was just trying to figure out whether
> something I saw in the netstat results was a likely security concern.
> When I use only netstat the first two lines shows this:
> Proto Local Address Foreign Address State
> TCP myserver:microsoft-ds myserver:1383 Established
> TCP myserver:1383 myserver:microsoft-ds Established
> When I did netstat -nb | more, as you suggested I got this:
> Proto Local Address Foreign Address State PID TCP 127.0.0.1:445
> 127.0.0.1:1383 ESTABLISHED 4
> [System]
> TCP 127.0.0.1:1383 127.0.0.1:445 ESTABLISHED 4
> [System]
> I am not sure why my localhost is connecting to itself. Could it be
> because I am running a DNS server? (I know my questions must seem very
> silly to those who actually know about this stuff).
> Could you recommend any specific resources to learn more about Windows
> 2003 server security?
> Thanks,
> J.S.
> Miha Pihler [MVP] wrote:
>> Hi,
>> What information are you looking for? Microsoft-DS TCP port is TCP port
>> 445. This port is also commonly referred to as SMB or CIFS.
>> About 1383 port. Since Windows will often dynamically assign ports to
>> different services it is hard to tell what actually runs behind this port
>> (which service). Once way to find out is to run following command...
>> netstat -nb | more
>> It will display something like this...
>> TCP 10.10.190.74:1956 10.10.2.46:3389 ESTABLISHED
>> 2072
>> [mstsc.exe]
>> This means that mstsc program is connecting from IP address 10.10.190.74
>> to 10.10.2.46 on TCP port 3389...
>> After you know which service is running on this port, you can decide if
>> you need it or if it can be shut down and disabled.
>>

> Hi,
>
> Here are some good articles and white papers on security...
>
> http://www.microsoft.com/security/default.mspx
>
> Service overview and network port requirements for the Windows Server system
>

>
> Threats and Countermeasures
>

>
> Windows Server 2003 Security Guide
>

>