Security Basics mailing list archives
RE: How to find process behing TCP connection ?
From: "Buozis, Martynas" <martynas () ti com>
Date: Thu, 28 Sep 2006 20:12:04 +0200
Thnaks for an update. I hope I understand what options software provide, but threads do not give any clue, because there are many threads and not possible to tie thread with TCP/IP connection. I may ask if you tried by yourself ever go to System 4 TCP/IP connections list and find which exactly program (at least thread) triggered this particular connection. With best regards Martynas -----Original Message----- From: listbounce () securityfocus com [mailto:listbounce () securityfocus com] On Behalf Of Colin Copley Sent: Wednesday, September 27, 2006 11:59 PM To: Buozis, Martynas Cc: security-basics () securityfocus com Subject: Re: How to find process behing TCP connection ? Still not sure I quite understand, but if Process Explorer (v10.2?) is showing the process as "system 4" but not telling you the exe name right?, try a right click and check out the threads tab in the properties dialog box, perhaps this will point to any other dll's or exe's this process is calling out to, if they are not system files then they could be known malware dll's which might betray it. Otherwise check out who is logged into the box & from where. ----- Original Message ----- From: "Buozis, Martynas" <martynas () ti com> Maybe I was not clear. Windows Server 2003 is acting as client and initiates connection to service on port 139 too many workstations. Actually it tries to logon as Administrator to many computers. And process, that initiates connection, is "System 4". There are no reasons why this server should connect to any of these workstations. Per configuration attempt to logon as Admin is denied. I set up open system and expect server will try to connect to it, so maybe I will understand better what is behind activity, but I am also sure, that more people got same problem for different reasons and they are willing to share their experience. So easy under Unix with LSOF and not possible under Windows ?... Can't believe! With best regards Martynas ------------------------------------------------------------------------ --- This list is sponsored by: Norwich University EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE The NSA has designated Norwich University a center of Academic Excellence in Information Security. Our program offers unparalleled Infosec management education and the case study affords you unmatched consulting experience. Using interactive e-Learning technology, you can earn this esteemed degree, without disrupting your career or home life. http://www.msia.norwich.edu/secfocus ------------------------------------------------------------------------ --- --------------------------------------------------------------------------- This list is sponsored by: Norwich University EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE The NSA has designated Norwich University a center of Academic Excellence in Information Security. Our program offers unparalleled Infosec management education and the case study affords you unmatched consulting experience. Using interactive e-Learning technology, you can earn this esteemed degree, without disrupting your career or home life. http://www.msia.norwich.edu/secfocus ---------------------------------------------------------------------------
Current thread:
- Re: Best single source of current infosec news?, (continued)
- Re: Best single source of current infosec news? Alexander Bolante (Sep 26)
- RE: Best single source of current infosec news? Bryan_McAninch (Sep 26)
- How to find process behing TCP connection ? Buozis, Martynas (Sep 27)
- Re: How to find process behing TCP connection ? Colin Copley (Sep 27)
- RE: How to find process behing TCP connection ? Buozis, Martynas (Sep 27)
- Re[2]: How to find process behing TCP connection ? Roman Shirokov (Sep 28)
- RE: How to find process behing TCP connection ? Simon Zuckerbraun (Sep 29)
- RE: How to find process behing TCP connection ? Buozis, Martynas (Sep 27)
- Re: How to find process behing TCP connection ? Danux (Sep 28)
- Re: How to find process behing TCP connection ? Colin Copley (Sep 28)
- RE: How to find process behing TCP connection ? Buozis, Martynas (Sep 28)
- How to find process behing TCP connection ? Buozis, Martynas (Sep 27)
- Re: How to find process behing TCP connection ? Daniel DeLeo (Sep 28)
- Re: How to find process behing TCP connection ? Mario A. Spinthiras (Sep 29)
- Re: How to find process behing TCP connection ? Daniel DeLeo (Sep 29)
- Re: How to find process behing TCP connection ? Ansgar -59cobalt- Wiechers (Sep 28)
- Re: How to find process behing TCP connection ? Mario A. Spinthiras (Sep 28)
- Re: How to find process behing TCP connection ? Ansgar -59cobalt- Wiechers (Sep 27)
- Re: How to find process behing TCP connection ? Mario A. Spinthiras (Sep 28)
- Re: How to find process behing TCP connection ? Umil (Sep 28)
- RE: How to find process behind TCP connection ? Robert D. Holtz - Lists (Sep 28)
- RE: How to find process behind TCP connection ? Buozis, Martynas (Sep 28)