Wireshark · Ethereal-users: Re: [Ethereal-users] microsoft-ds [SYN] frames flooding my system

[Guy Harris <gharris@xxxxxxxxx>]

Guy Harris wrote:

> 445 is the TCP port number they're trying to connect to; that'd show up 
> in the Ethereal trace as well, and you don't have to muck around with 
> text files to find it.

Oh, and the "SYN" is an indication that this is an attempt to make a TCP 
connection (to port 445, in this case).  There's probably a tutorial on 
TCP that talks about the "three-way handshake" for making a connection 
(machine A sends a packet with a SYN to machine B; machine B 
acknowledges the SYN, indicating that it received the SYN, and replies 
with a SYN of its own, indicating that it's willing to accept the 
connection, in a packet with SYN+ACK; machine A then acknowledges the 
SYN it got from machine B, in a packet with ACK).  Google for "TCP 
tutorial".