| Description | This article describes that the collectoragent.exe (FSSO) sends traffic to port 139 / 445 / 389 to the user IP (internal or external IP address). |
| Scope | FSSO, FortiGate, collecteragent.exe. |
| Solution |
Refer to the following truncated pcap where:
FSSO IP is 10.59.x.x (Source). The client IP is 10.48.x.x (Destination).
It can be seen that the collector agent is trying to send traffic to the client via port 139 / 445 / 389.
This is an expected behavior for workstation checks, and it is done whether the client has an internal or external IP address. It will check port 139 445 or 389 to see if the workstation is online.
Related article: |
