Thursday, October 30, 2008

Blocking Ports 139 and 445

In an effort to protect our network against the new Gimmiv Worm it was reccomended to block traffic using ports 139 and 445. I went ahead and blocked all traffic, internal and external, to these ports. After completing this we started noticing connection issues to some of the shared folders on some of our servers. The bulk of the issues were coming from computers on one network of our WAN connecting to a server on a different network on our WAN. After some testing I was able to determine that is issue was a result of blocking these ports. It looks like I should have only blocked inbound traffic to these ports. Windows relys on these ports for connectivity to the network.

I found a great posting that explains what these ports do. http://www.petri.co.il/what

No comments: