Too many established connections on port 445 microsoft-ds

Question

We have a 2008 r2 server as a application server on VM, there has been huge number of connections established to the port 445 with a system PID 4 all connections are from our domain, there are no roles for this server to be a file server or web server. sniffer
logs detect SMB traffic with similar pattern request from this server to other of our application servers & DC
0.000000 10.10.0.10
10.10.40.22 SMB2
316 Session Setup Response
0.000000 10.10.40.22
10.10.0.10 SMB2
170 Tree Connect Request Tree: \\appserv009\IPC$
0.000000 10.10.0.10
10.10.40.22 SMB2
138 Tree Connect Response
0.000000 10.10.40.22
10.10.0.10 SMB2
216 Ioctl Request FSCTL_DFS_GET_REFERRALS, File: \appserv009\c$
0.000000 10.10.0.10
10.10.40.22 SMB2
131 Ioctl Response, Error: STATUS_FS_DRIVER_REQUIRED
0.000000 10.10.40.22
10.10.0.10 SMB2
166 Tree Connect Request Tree: \\appserv009\c$
0.000000 10.10.0.10
10.10.40.22 SMB2
131 Tree Connect Response, Error: STATUS_ACCESS_DENIED
0.000000 10.10.40.22
10.10.0.10 SMB2
166 Tree Connect Request Tree: \\appserv009\c$
0.000000 10.10.0.10
10.10.40.22 SMB2
131 Tree Connect Response, Error: STATUS_ACCESS_DENIED
0.000000 10.10.40.22
10.10.0.10 TCP
60 58203 > microsoft-ds [ACK] Seq=2650 Ack=1082 Win=64512 Len=0
12.000000 10.10.40.22
10.10.0.10 SMB2
126 Tree Disconnect Request
12.000000 10.10.0.10
10.10.40.22 SMB2
126 Tree Disconnect Response
12.000000 10.10.40.22
10.10.0.10 SMB2
126 Session Logoff Request
12.000000 10.10.0.10
10.10.40.22 SMB2
126 Session Logoff Response
There is no big traffic for these connections other than some bytes, but the number of the requests are going up in hundreds on the 445 port. On blocking the port 445 on the firewall rule same connections were seen to go on 139.
How to detect why this connections are being generated.

Answer 1

Hi,
As far as I know, Ports 445 and 139 are used for TCP session establishment and file/printer sharing traffic. Besides, Port 445 is also used for AD access and authentication by Microsoft-DS.
In addition, if the client has NetBIOS over TCP/IP enabled, it will always try to connect to the server at both port 139 and 445 simultaneously. If there is a response from port 445, it sends a RST to port 139, and continues its SMB session to port 445 only.
If there is no response from port 445, it will continue its SMB session to port 139 only if it gets a response from there. If the client has NetBIOS over TCP/IP disabled, it will always try to connect to the server at port 445 only.
The link below may be helpful to you:
Service overview and network port requirements for Windows
Best regards,
Susie