Many packets sent to domain controller

[leblanc_daniel_]

The trouble my security groupe found that LanSweeper server gave out over 10K paquets with in an hours to 4 DC server(2 root AD et 2 child domain) why so much?

LanSweeperServer
SERVERDC03.child domain Ports : 88,135, 445,389, 49157, 49159
SERVERDC04.Child domain
SERVERDC01.Root AD
SERVERDC02.Root AD

This is whar we get when we scan:
SERVER250 Ports : 135, 139,161,445,21,25,80,443,5060

Why so much paquet between LanSweeper and DC (Domain Controller)

[Daniel_B · Accepted solution]

Created a new forum topic for your question as it was not directly related to the question you posted before.

Lansweeper contacts your domain controller

• during each scan of a Windows computer in order to look up AD computer or user accounts related to this computer. The number of requests per hour depends on the number of computers you are scanning, the number of users which were scanned on these and your settings under Configuration\Server options, sections Asset Cleanup options and User cleanup options. This traffic should only happen on port 389/TCP.
  
• every 15 minutes (by default) for Active scanning
  
• at the beginning of each scanning cycle for Scheduled computer scanning, Domain user scanning, Scheduled eventlog scanning in case you submitted OU's for scanning
  
• during scanning of the domain controller host machine itself

We recommend as well that you investigate which service was the origin of this traffic.