Re: How to find process behing TCP connection ?

["Michael Painter" <tvhawaii () shaka com>]

----- Original Message ----- 
From: "Steve Armstrong" <stevearmstrong () logicallysecure com>
To: "Buozis, Martynas" <martynas () ti com>; "Colin Copley" <colin.75 () btinternet com>
Cc: <security-basics () securityfocus com>
Sent: Friday, September 29, 2006 8:10 AM
Subject: RE: How to find process behing TCP connection ?


> The two best tools are tcpview and process explorer.  Both are by sysinternals.  Tcpview will show connections  and what process 
> is behind it, and the remote address.
>
> Process  explorer is an excellent  tool that will show all processes.  Hover your mouse over a listing and it will list what it 
> provides eg svchost! Very cool.  You can also look at what port, remote connection, memory and resources are being used.  You can 
> even look at the strings in the file.
>
> Get these two and burn them to a cdrom - they make a great incident identification tool kit.
>
> Also given the @stake tool posting yesterday, get these now, as microsoft  has bought sysinternals so the day will come where 
> these are either not free nor not available.
>
> I have downloaded all the sysinternals  tools and will post a link to the complete zip in the next few days.
>
> Hope this is of use to you.
>
> Steve A



This one is also worth a look (free for non-commercial use), and has 'snapshot' capabilities:

http://www.whatsrunning.net/whatsrunning/Screenshots.aspx

--Michael



---------------------------------------------------------------------------
This list is sponsored by: Norwich University

EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The NSA has designated Norwich University a center of Academic Excellence 
in Information Security. Our program offers unparalleled Infosec management 
education and the case study affords you unmatched consulting experience. 
Using interactive e-Learning technology, you can earn this esteemed degree, 
without disrupting your career or home life.

http://www.msia.norwich.edu/secfocus
---------------------------------------------------------------------------