Security Basics mailing list archives
Re: How to find a process
From: "Nikhil Wagholikar" <visitnikhil () gmail com>
Date: Thu, 14 Jun 2007 10:54:22 +0530
Hello Fran, If your server is running a copy of Windows Server 2000 & above, then at the command prompt of the server, type "netstat -ano". You'll get a listing of locally open ports along with it connection to foreign IP Address with it's PID number. Now pick up this PID number & look into Windows Task Manager to see which process does the PID number belongs to. Besides this tedious technique, a simpler technique is to use "Process Explorer" from Sysinternals or "TCPMon". Process Explorer: http://www.microsoft.com/technet/sysinternals/utilities/ProcessExplorer.mspx TCPMon: https://tcpmon.dev.java.net/ However if your server is UNIX based, then you can try "netstat -antp" for TCP & "netstat -anup" for UDP protocols connections currently active on your server. Popular 'lsof' command (needs to be installed seperatly) can also help you in this regard. Besides this, running a Vulnerability Scanner (like Nessus) against this server is also a recommended step before it gets totally compromised. Nessus: http://www.nessus.org/download/ ------ Nikhil Wagholikar Security Analyst NII Consulting www.niiconsulting.com On 6/13/07, Francisco Rodrigo Cortinas Maseda <francisco.cortinas () jazztel com> wrote:
Hello, my name is Fran, im a network and system administrator, and i have a strange case, but sure somenone have had the same problem before me. My problem is that we have some strange traffic on the firewalls, going from a server on a DMZ to public client pools. 10:09:10.511978 00:0e:0c:71:7f:cd > 10:00:00:00:26:01, ethertype IPv4 (0x0800), length 61: IP XXXXX.44267 > XXXXXX.3072: UDP, length 19 The problem is: with netstat i only see the ports daemons are listening on. I want to know the process that is using the outgoing port, that is, 44267. Is there a way to know this? Thanks in advance. Regards.
Current thread:
- How to find a process Francisco Rodrigo Cortinas Maseda (Jun 13)
- Re: How to find a process Jason Ross (Jun 14)
- Re: How to find a process Jason Ross (Jun 14)
- Re: How to find a process Shane Warner (Jun 14)
- RE: How to find a process Shortz, Alan (Jun 14)
- Re: How to find a process Nikhil Wagholikar (Jun 14)
- Re: How to find a process Ansgar -59cobalt- Wiechers (Jun 14)
- Re: How to find a process Matthias Merk (Jun 14)
- Re: How to find a process Pingu (Jun 14)
- Re: How to find a process Pranay Kanwar (Jun 14)
- RE: How to find a process Nichol.Deaddis (Jun 14)
- Re: How to find a process Tsu (Jun 14)
- RE: How to find a process M. Waseem Sindhu (Jun 14)
- Re: How to find a process Roman Shirokov (Jun 14)
- Re: How to find a process Ansgar -59cobalt- Wiechers (Jun 14)
- Re: How to find a process Manuel GarcĂa (Jun 14)
(Thread continues...)
- Re: How to find a process Jason Ross (Jun 14)