Re: How to find process behing TCP connection ?

[eromero () altep com]

Not sure if it has been mentioned before but you can also use tcpview from sysinternal.com. You can use this in 
combination with processxp or somthing like that. This tool is handy to take the svhost process apart..
Sent from my BlackBerry wireless handheld without spellcheck.  

-----Original Message-----
From: "Don Parker" <dparker () bridonsecurity com>
Date: Thu, 28 Sep 2006 11:50:02 
To:"Mario A. Spinthiras" <mario () netway com cy>,       Colin Copley <colin.75 () btinternet com>
Cc:"Buozis,  Martynas" <martynas () ti com>, security-basics () securityfocus com
Subject: Re: How to find process behing TCP connection ?


You may wish to download the program ActivePorts. This will map what program has spawned 
the the process of interest, and also show you where on your hard drive the program 
resides.

Hope this helps

--------------------------------------------------------------
Don Parker, GCIA GCIH
Intrusion Detection & Incident Handling Specialist
Bridon Security & Training Services
http://www.bridonsecurity.com
voice: 1-613-302-2910
-------------------------------------------------------------- 

On Sep 28, "Mario A. Spinthiras" <mario () netway com cy> wrote:

Colin Copley wrote:
> Maybe this is some help?
>
> <a href='http://forum.sysinternals.com/forum_posts.asp?
TID=3432'>http://forum.sysinternals.com/forum_posts.asp?TID=3432</a>
> If not, perhaps you could attempt to telnet or putty into the port, and see
> if it returns an error message which might give some more info.
> Another idea - try ethereal to capture the packet data and see what it
> contains.
> Also I believe nmap can attempt to establish what's listening on a certain
> port.  It might give you more info than just system 4.
> Regards
> Colin
>
>
> ----- Original Message ----- 
> From: "Buozis, Martynas" <martynas () ti com>
> Hello
>
> I need an advice. I have Windows 2003 server. It occasionally show
> strange and suspicious network behavior. I used command "netstat -abov"
> and Process explorer tool from Sysinternals to find process behind
> connections. I found that it is "System 4" and got stuck. How I can
> identify what is behind this "System 4"?
>
> I thought it may be hidden process, but RootkitReveal from Systinternals
> did not show anything.
>
> I will be grateful for any ideas how to identify what is behind these
> TCP connections from server to many computers!
>
> Thank you in advance.
>
> With best regards
> Martynas
>
>
>
> ---------------------------------------------------------------------------
> This list is sponsored by: Norwich University
>
> EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
> The NSA has designated Norwich University a center of Academic Excellence 
> in Information Security. Our program offers unparalleled Infosec management 
> education and the case study affords you unmatched consulting experience. 
> Using interactive e-Learning technology, you can earn this esteemed degree, 
> without disrupting your career or home life.
>
> <a href='http://www.msia.norwich.edu/secfocus&apos;>http://www.msia.norwich.edu/secfocus</a>
> ---------------------------------------------------------------------------
>
>
>   
/usr/sbin/lsof <--- use that

If you are on windows , then download the cygwin package , which 
contains lsof which in continuation you can use to resolve your issue.

Regards,
Mario A. Spinthiras





---------------------------------------------------------------------------
This list is sponsored by: Norwich University

EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The NSA has designated Norwich University a center of Academic Excellence 
in Information Security. Our program offers unparalleled Infosec management 
education and the case study affords you unmatched consulting experience. 
Using interactive e-Learning technology, you can earn this esteemed degree, 
without disrupting your career or home life.

<a href='http://www.msia.norwich.edu/secfocus&apos;>http://www.msia.norwich.edu/secfocus</a>
---------------------------------------------------------------------------



---------------------------------------------------------------------------
This list is sponsored by: Norwich University

EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The NSA has designated Norwich University a center of Academic Excellence 
in Information Security. Our program offers unparalleled Infosec management 
education and the case study affords you unmatched consulting experience. 
Using interactive e-Learning technology, you can earn this esteemed degree, 
without disrupting your career or home life.

http://www.msia.norwich.edu/secfocus
---------------------------------------------------------------------------