Security Basics mailing list archives
Re: How to find process behing TCP connection ?
From: "Umil" <umil () hotmail com>
Date: Thu, 28 Sep 2006 15:04:29 -0300
you can also try the cport tool. I use it a lot----- Original Message ----- From: "Mario A. Spinthiras" <mario () netway com cy>
To: "Buozis, Martynas" <martynas () ti com> Cc: <security-basics () securityfocus com> Sent: Thursday, September 28, 2006 3:29 AM Subject: Re: How to find process behing TCP connection ?
Buozis, Martynas wrote:I'm not a windows guru but presumably you can go by it through the *nix method.Hello I need an advice. I have Windows 2003 server. It occasionally show strange and suspicious network behavior. I used command "netstat -abov" and Process explorer tool from Sysinternals to find process behind connections. I found that it is "System 4" and got stuck. How I can identify what is behind this "System 4"? I thought it may be hidden process, but RootkitReveal from Systinternals did not show anything. I will be grateful for any ideas how to identify what is behind these TCP connections from server to many computers! Thank you in advance. With best regards Martynas --------------------------------------------------------------------------- This list is sponsored by: Norwich University EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINEThe NSA has designated Norwich University a center of Academic Excellence in Information Security. Our program offers unparalleled Infosec management education and the case study affords you unmatched consulting experience. Using interactive e-Learning technology, you can earn this esteemed degree, without disrupting your career or home life.http://www.msia.norwich.edu/secfocus ---------------------------------------------------------------------------Get CYGWIN from Redhat. make sure you install stuff like lsof and ps from the packages. (and top). These are all commands from *nix based environments that help out in situations like this.They should help you see whats going on your microshoft system Regards, Mario A. Spinthiras --------------------------------------------------------------------------- This list is sponsored by: Norwich University EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINEThe NSA has designated Norwich University a center of Academic Excellence in Information Security. Our program offers unparalleled Infosec management education and the case study affords you unmatched consulting experience. Using interactive e-Learning technology, you can earn this esteemed degree, without disrupting your career or home life.http://www.msia.norwich.edu/secfocus ---------------------------------------------------------------------------
--------------------------------------------------------------------------- This list is sponsored by: Norwich University EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINEThe NSA has designated Norwich University a center of Academic Excellence in Information Security. Our program offers unparalleled Infosec management education and the case study affords you unmatched consulting experience. Using interactive e-Learning technology, you can earn this esteemed degree, without disrupting your career or home life.
http://www.msia.norwich.edu/secfocus ---------------------------------------------------------------------------
Current thread:
- Re: How to find process behing TCP connection ?, (continued)
- Re: How to find process behing TCP connection ? Danux (Sep 28)
- Re: How to find process behing TCP connection ? Colin Copley (Sep 28)
- RE: How to find process behing TCP connection ? Buozis, Martynas (Sep 28)
- Re: How to find process behing TCP connection ? Daniel DeLeo (Sep 28)
- Re: How to find process behing TCP connection ? Mario A. Spinthiras (Sep 29)
- Re: How to find process behing TCP connection ? Daniel DeLeo (Sep 29)
- Re: How to find process behing TCP connection ? Ansgar -59cobalt- Wiechers (Sep 28)
- Re: How to find process behing TCP connection ? Mario A. Spinthiras (Sep 28)
- Re: How to find process behing TCP connection ? Ansgar -59cobalt- Wiechers (Sep 27)
- Re: How to find process behing TCP connection ? Mario A. Spinthiras (Sep 28)
- Re: How to find process behing TCP connection ? Umil (Sep 28)
- RE: How to find process behind TCP connection ? Robert D. Holtz - Lists (Sep 28)
- RE: How to find process behind TCP connection ? Buozis, Martynas (Sep 28)