1

After checking my SMB logs as to why I keep getting errors on my NAS about a failed login, I noticed that an old NAS that I've not had access to, and removed from my PC, over six months ago, is readily flooding my SMB failures logs. How can I check where this is being triggered from and how can I remove it?

enter image description here

Alex
  • 125
  • What was the old nas, and what do you mean by 'removing' it? – Journeyman Geek Apr 01 '23 at 14:00
  • @JourneymanGeek: I'm not sure that this post should have been closed. – harrymc Apr 01 '23 at 14:40
  • It can be reopened with enough information, which I don't feel like this has right now. There's not really enough information of what's going on, just a mention of a specific error. – Journeyman Geek Apr 01 '23 at 14:41
  • @JourneymanGeek It's no longer on my network, and I have no physical access to it. What more information would you need to re-open this? – Alex Apr 01 '23 at 16:31

1 Answers1

0

Some software is attempting to reach 10.0.0.8:443. As port 443 is the HTTPS port or the QUIC UDP port, it might not be SMB after all.

Examine your running processes for ideas, especially ones that might have been connected to the old NAS.

If this is happening with good frequency, you could use Process Monitor to trace all network actions using the filter of "Event class" value of "Network". Process Monitor generates a huge log, so leaving it monitoring for a long time is not recommended.

harrymc
  • 480,290
  • 1
    You're likely right about it not being SMB, but wrong about it being HTTPS - https://en.wikipedia.org/wiki/QUIC seems a thing, I wonder if its some management app that runs over it – Journeyman Geek Apr 01 '23 at 13:59
  • Process Monitor managed to point me to the issue, being that ASUS Armoury Crate was trying to search for it, but there was no way to remove it from the software.. Uninstall did the trick of that! – Alex Apr 02 '23 at 11:12