I was alarmed by the network monitoring team that there is some UDP traffic headed to the Internet on port 137 which was detected as SMB traffic by our monitoring solution. What is interesting is that this traffic starts as soon as I log into the PC and reaches many different destinations - sometimes hostnames, sometimes IP addresses.

I tried to inspect the requests via Wireshark but that was of little use so I then used Microsoft Network Monitor which is supposed to show you which process caused the outgoing traffic. Unfortunately, MS Netmon doesn't recognize any processes and says "System" instead:

enter image description here

What is even more interesting is that the requests are empty as can be seen in the screenshot above. Host destinations seem legitimate - e.g.:

pixel.wp.com (Wordpress)
wd-prod-ss-eu-north-1-fe.northeurope.cloudapp.azure.com (Azure)
refer.wordpress.com (Wordpress)
r5.sn-h5q7knez.googlevideo.com (Google)

IP addresses, on the other hand, seem to belong to big corporations such as Microsoft.

Of all PCs in the network, this only affects my PC and I tried scanning the local machine for any threats to no avail. One thing that I noticed is that there were a lot of requests to domains containing Skype in their name - they seem to have reduced in number once I stopped Skype / Teams but still kept on showing - in this screenshot for example, all requests after 11:19:00 are running with both Skype and Microsoft Teams stopped:

enter image description here

How can I further debug what causes the communication and whether it is a security threat?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.