Ethereal-users: Re: [Ethereal-users] TCP 1061 (Kiosk) and TCP 445 (microsoft-ds) traffic

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <gharris@xxxxxxxxx>
Date: Tue, 04 Jan 2005 11:56:42 -0800
Hector Laya wrote:

I`m having a TCP traffic between my pc (windows XP) and a server (w2K3) that I really don`t know what could be. Never heard before of Kiosk protocol (TCP 1061) and don`t know what is doing in my pc. I did a scan for open ports in my pc but nothing its open....

Most TCP and UDP port numbers aren't strictly assigned to particular protocols - just because traffic happens to use a port number assigned to a protocol, that doesn't necessarily mean the traffic is traffic for that protocol.

If there's TCP traffic between ports 1061 and 445, and it's traffic between an SMB client (such as your PC might be) and an SMB server (such as the W2K3 machine might be), it might be SMB traffic that happens to come from port 1061 rather than port 1063 or 1060 or 666 or 17432 or - it doesn't necessarily mean that it's "kiosk protocol" traffic, it could be SMB-over-TCP traffic, the port number for which is 445 (rather than SMB-over-"NetBIOS-over-TCP", where the traffic is mainly on port 139, except for some NetBIOS-over-UDP traffic on ports 137 and 138.