Hi there, I have a server that, when connecting to a file share, say through windows explorer, it is attempting to connect on port 80, which of course fails. Can anyone shed any light on why this might be happening and how to resolve? e.g. \\172.16.172.3 C:\Users\admin>netstat -n | findstr 172 TCP 172.16.177.203:50909 172.16.172.3:80 SYN_SENT Regards, Matt

Hi Matt, Thanks for posting here. What’s the particular system error message when failed access ? What’s the OS version running on host 172.16.172.3? and have also deployed other services except file service on that server host ? Would this issue also occurred on other computers ? Please check if it would persist when access share folder by using mapped drives instead of UNC connections? Please capture SMB network traffics by using network monitor when access share folder and post the captured data here for further investigation. Meanwhile, please also post the full export result of netshtat –n here. Microsoft Network Monitor 3.4 http://www.microsoft.com/downloads/en/details.aspx?FamilyID=983b941d-06cb-4658-b7f6-3088333d062f&displaylang=en Thanks. Tiger Li TechNet Subscriber Support in forum If you have any feedback on our support, please contact tngfb@microsoft.comPlease remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Hi Matt, If there is any update on this issue, please feel free to let us know. We are looking forward to your reply. Thanks. Tiger Li TechNet Subscriber Support in forum If you have any feedback on our support, please contact tngfb@microsoft.com Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Hi Tiger Li, Apologies for the delay, i was out of the office yesterday, thanks for your assistance. I am filesharing from a 2008 R2 server. 172.16.172.7 is a samba share on a solaris box, however, the same is occuring on other file shares this is also occurring when attempting filesharing across different NICs in this host. The following is a 2008 sp2 server, which is a simple web server: C:\Users\icoadmin>netstat -n | findstr 172 TCP 172.16.177.203:51532 172.16.172.12:80 ESTABLISHED I'll stick with the 172.16.172.12 example going forward since it's windows to windows. Mapped drives produce the same problem. Full netstat while attempting to connect to 172.16.172.12 C:\Users\icoadmin>netstat -n Active Connections Proto Local Address Foreign Address State TCP 172.16.177.203:51538 172.16.172.12:80 ESTABLISHED TCP 192.168.35.18:139 192.168.35.20:53446 ESTABLISHED TCP 192.168.35.18:1433 203.143.242.218:3541 ESTABLISHED TCP 192.168.35.18:3389 202.191.54.243:2011 ESTABLISHED TCP 192.168.35.18:12489 202.191.54.60:56779 TIME_WAIT TCP 192.168.35.18:12489 202.191.54.60:57083 TIME_WAIT TCP 192.168.35.18:12489 202.191.54.60:57197 TIME_WAIT TCP 192.168.35.18:12489 202.191.54.60:58107 TIME_WAIT TCP 192.168.35.18:12489 202.191.54.60:58307 TIME_WAIT TCP 192.168.35.18:12489 202.191.54.60:58320 TIME_WAIT TCP 192.168.36.18:1433 192.168.36.17:4114 ESTABLISHED TCP 192.168.36.18:1433 192.168.36.20:49226 ESTABLISHED TCP 192.168.36.18:1433 192.168.36.20:53401 ESTABLISHED TCP 192.168.36.18:1433 192.168.36.20:54370 ESTABLISHED TCP 192.168.36.18:1433 192.168.36.20:64556 ESTABLISHED TCP 192.168.36.18:1433 192.168.36.20:64653 ESTABLISHED TCP 192.168.36.18:1433 192.168.36.20:64984 ESTABLISHED TCP 192.168.36.18:1433 192.168.36.20:65204 ESTABLISHED TCP 192.168.36.18:1433 192.168.36.71:1276 ESTABLISHED TCP 192.168.36.18:1433 192.168.36.71:1734 ESTABLISHED TCP 192.168.36.18:1433 192.168.36.71:1735 ESTABLISHED TCP 192.168.36.18:1433 192.168.36.71:1736 ESTABLISHED TCP 192.168.36.18:1433 192.168.36.71:1737 ESTABLISHED TCP 192.168.36.18:1433 192.168.36.71:1738 ESTABLISHED TCP 192.168.36.18:1433 192.168.36.71:1740 ESTABLISHED TCP 192.168.36.18:1433 192.168.36.71:1741 ESTABLISHED TCP 192.168.36.18:1433 192.168.36.71:1743 ESTABLISHED TCP 192.168.36.18:1433 192.168.36.71:1744 ESTABLISHED TCP 192.168.36.18:1433 192.168.36.71:1745 ESTABLISHED TCP 192.168.36.18:1433 192.168.36.71:1746 ESTABLISHED TCP 192.168.36.18:1433 192.168.36.71:1747 ESTABLISHED TCP 192.168.36.18:1433 192.168.36.71:1748 ESTABLISHED TCP 192.168.36.18:1433 192.168.36.71:1749 ESTABLISHED TCP 192.168.36.18:1433 192.168.36.71:1750 ESTABLISHED TCP 192.168.36.18:1433 192.168.36.71:1751 ESTABLISHED TCP 192.168.36.18:1433 192.168.36.71:1752 ESTABLISHED TCP 192.168.36.18:1433 192.168.36.71:1753 ESTABLISHED TCP 192.168.36.18:1433 192.168.36.71:1754 ESTABLISHED TCP 192.168.36.18:1433 192.168.36.71:1755 ESTABLISHED TCP 192.168.36.18:1433 192.168.36.71:1756 ESTABLISHED TCP 192.168.36.18:1433 192.168.36.71:1757 ESTABLISHED TCP 192.168.36.18:1433 192.168.36.71:1758 ESTABLISHED TCP 192.168.36.18:1433 192.168.36.71:1761 ESTABLISHED TCP 192.168.36.18:1433 192.168.36.71:1762 ESTABLISHED TCP 192.168.36.18:1433 192.168.36.71:1763 ESTABLISHED TCP 192.168.36.18:1433 192.168.36.71:1770 ESTABLISHED TCP 192.168.36.18:1433 192.168.36.71:1773 ESTABLISHED TCP 192.168.36.18:1433 192.168.36.71:3109 ESTABLISHED TCP 192.168.36.18:1433 192.168.36.71:3192 ESTABLISHED TCP 192.168.36.18:1433 192.168.36.71:3326 ESTABLISHED TCP 192.168.36.18:1433 192.168.36.71:3418 ESTABLISHED TCP 192.168.36.18:1433 192.168.36.71:4356 ESTABLISHED TCP 192.168.36.18:1433 192.168.36.71:4664 ESTABLISHED TCP 192.168.36.18:1433 192.168.36.71:4665 ESTABLISHED TCP 192.168.36.18:1433 192.168.36.81:3770 ESTABLISHED TCP 192.168.36.18:1433 192.168.36.81:3775 ESTABLISHED I have doen the capture as requested also, but can't see how to attach it to this post. Can you please advise? Regards, Matt

although i can't seem to attach the capture, looking at it i see the following - it seems to be using webdav for some reason. 2804 11:29:12 AM 1/12/2010 9.8396880 svchost.exe ICO-4509DB8VIRT<00> 172.16.172.12 TCP TCP:Flags=......S., SrcPort=51607, DstPort=HTTP(80), PayloadLen=0, Seq=416006345, Ack=0, Win=8192 ( ) = 8192 {TCP:513, IPv4:512} 2805 11:29:12 AM 1/12/2010 9.8411195 svchost.exe 172.16.172.12 ICO-4509DB8VIRT<00> TCP TCP:Flags=...A..S., SrcPort=HTTP(80), DstPort=51607, PayloadLen=0, Seq=3359545245, Ack=416006346, Win=8192 ( Scale factor not supported ) = 8192 {TCP:513, IPv4:512} 2806 11:29:12 AM 1/12/2010 9.8411438 svchost.exe ICO-4509DB8VIRT<00> 172.16.172.12 TCP TCP:Flags=...A...., SrcPort=51607, DstPort=HTTP(80), PayloadLen=0, Seq=416006346, Ack=3359545246, Win=64240 (scale factor 0x0) = 64240 {TCP:513, IPv4:512} 2807 11:29:12 AM 1/12/2010 9.8412449 svchost.exe ICO-4509DB8VIRT<00> 172.16.172.12 WEBDAV WEBDAV:Request, OPTIONS / {HTTP:514, TCP:513, IPv4:512} 2808 11:29:12 AM 1/12/2010 9.8443221 svchost.exe 172.16.172.12 ICO-4509DB8VIRT<00> WEBDAV WEBDAV:Response, HTTP/1.1, Status: Ok, URL: / {HTTP:514, TCP:513, IPv4:512} 3034 11:29:12 AM 1/12/2010 10.0478796 svchost.exe ICO-4509DB8VIRT<00> 172.16.172.12 TCP TCP:Flags=...A...., SrcPort=51607, DstPort=HTTP(80), PayloadLen=0, Seq=416006476, Ack=3359545452, Win=64034 (scale factor 0x0) = 64034 {TCP:513, IPv4:512} 3193 11:29:15 AM 1/12/2010 12.4074090 svchost.exe ICO-4509DB8VIRT<00> 172.16.172.12 WEBDAV WEBDAV:Request, PROPFIND / {HTTP:514, TCP:513, IPv4:512} 3194 11:29:15 AM 1/12/2010 12.4137811 svchost.exe 172.16.172.12 ICO-4509DB8VIRT<00> HTTP HTTP:Response, HTTP/1.1, Status: Moved temporarily, URL: / {HTTP:514, TCP:513, IPv4:512} 3195 11:29:15 AM 1/12/2010 12.4489942 svchost.exe ICO-4509DB8VIRT<00> 172.16.172.12 WEBDAV WEBDAV:Request, PROPFIND /login.php {HTTP:514, TCP:513, IPv4:512} 3196 11:29:15 AM 1/12/2010 12.4544444 svchost.exe 172.16.172.12 ICO-4509DB8VIRT<00> HTTP HTTP:Response, HTTP/1.1, Status: Ok, URL: /login.php {HTTP:514, TCP:513, IPv4:512} 3197 11:29:15 AM 1/12/2010 12.4544444 svchost.exe 172.16.172.12 ICO-4509DB8VIRT<00> TCP TCP:[Continuation to #3196]Flags=...AP..., SrcPort=HTTP(80), DstPort=51607, PayloadLen=702, Seq=3359547462 - 3359548164, Ack=416006851, Win=63865 (scale factor 0x0) = 63865 {TCP:513, IPv4:512} 3198 11:29:15 AM 1/12/2010 12.4544798 svchost.exe ICO-4509DB8VIRT<00> 172.16.172.12 TCP TCP:Flags=...A...., SrcPort=51607, DstPort=HTTP(80), PayloadLen=0, Seq=416006851, Ack=3359548164, Win=64240 (scale factor 0x0) = 64240 {TCP:513, IPv4:512} 3938 11:29:17 AM 1/12/2010 15.1320827 svchost.exe ICO-4509DB8VIRT<00> 172.16.172.12 WEBDAV WEBDAV:Request, PROPFIND / {HTTP:514, TCP:513, IPv4:512} 3939 11:29:17 AM 1/12/2010 15.1358114 svchost.exe 172.16.172.12 ICO-4509DB8VIRT<00> HTTP HTTP:Response, HTTP/1.1, Status: Moved temporarily, URL: / {HTTP:514, TCP:513, IPv4:512} 3940 11:29:17 AM 1/12/2010 15.1359983 svchost.exe ICO-4509DB8VIRT<00> 172.16.172.12 WEBDAV WEBDAV:Request, PROPFIND /login.php {HTTP:514, TCP:513, IPv4:512} 3941 11:29:17 AM 1/12/2010 15.1412283 svchost.exe 172.16.172.12 ICO-4509DB8VIRT<00> HTTP HTTP:Response, HTTP/1.1, Status: Ok, URL: /login.php {HTTP:514, TCP:513, IPv4:512} 3942 11:29:17 AM 1/12/2010 15.1412283 svchost.exe 172.16.172.12 ICO-4509DB8VIRT<00> TCP TCP:[Continuation to #3941]Flags=...AP..., SrcPort=HTTP(80), DstPort=51607, PayloadLen=702, Seq=3359550116 - 3359550818, Ack=416007272, Win=63444 (scale factor 0x0) = 63444 {TCP:513, IPv4:512} 3943 11:29:17 AM 1/12/2010 15.1412476 svchost.exe ICO-4509DB8VIRT<00> 172.16.172.12 TCP TCP:Flags=...A...., SrcPort=51607, DstPort=HTTP(80), PayloadLen=0, Seq=416007272, Ack=3359550818, Win=64240 (scale factor 0x0) = 64240 {TCP:513, IPv4:512}

Hi Matt, Thanks for update. Could you try modify network provider order in NICs properties on both side hosts and make sure “web client network” NOT the top of list . Modify the protocol bindings and network provider order http://technet.microsoft.com/en-us/library/cc732472(WS.10).aspx Thanks. Tiger Li TechNet Subscriber Support in forum If you have any feedback on our support, please contact tngfb@microsoft.comPlease remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Hi Tiger Li, I have checked both hosts and they were all set with web client network as the lowest. I did move microsoft windows network to the top just to be sure, but same result. I'm sure it's not the remote share since it's happening for multiple destinations, but i did both anyway. Any other suggestions are welcome? Regards, Matt

when you are accessing using HTTP , windows uses WEBDAV . have you published your resources ?

Hi Guys, I have solved the problem. the TCP/IP NetBIOS Helper service had crashed, and the web client service was installed and running. I disabled the web client service, and restarted the TCP/IP NetBIOS Helper service, and bingo. Now gotta work out why it is crashing. Thanks for your help folks. Matt

Hi Matt, Glad you find out the way to solve this issue and share with us. Thanks Tiger LiPlease remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.