Windows 10: Why is the Windows 11 Spoolsv.exe process sending out SNMP and PDL ports 161, 9100...

While looking at the network traffic we have, from the perspective of our firewall, the logs were showing what I considered to be a problem that needed to be investigated more.There were WWW IPs showing up as being on our LAN and IPs that had our internal LAN prefix octets but do not exist on our LAN.The WWW

:)

 

SNMP help

The issue with polling from WAN is that the router will not know what to do with the incoming connection requesting the SNMP traps. Sure you could port forward the SNMP port from WAN to LAN but the network monitoring is probably IP based and on a private subnet (IS 192.168.1.x/24) and still at the point the router would not know what to send it too once it has entered. You could do a rule to port forward each IP individually with a virtual WAN port that translates to an IP and SNMP port on the LAN side but would take time if you have MANY devices. I would just suggest doing a IPSEC vpn tunnel between the off site router to the router on site.

 

SNMP help

I had tried previously to run the monitor internally on a server and just poll the devices directly over VPN which worked but the polling internval or traffic from the devices must have been too high because its caused outages network and site wide. Maybe I will look into it again and see if I misconfigured something previously.

Thanks.

 

SNMP Configuration

Hello guys,

I am going to configurate SNMP on some servers and clients with following considerations:

1. Servers must be monitored using our Monitoring system

2. Servers and some clients are supposed to send Traps to SIEM

For completing Task1, we installed SNMP option feature and configured SNMP server ( Security tab > community string and Accept packet from specific server). Now, monitoring server is able to poll information and make graphs.

But, for completing Task2, we have to change Destination Trap port. Because SIEM is listening on a port different than the default.

* It is important to keep listening on default port ( Because Monitoring server is POLLING information from that), and send trap to another port(Because SIEM is LISTENING to a customized port).

Could please help with this scenario and also a scenario in which both listening and sending ports would change.