Security Basics mailing list archives
RE: How to find process behing TCP connection ?
From: "Buozis, Martynas" <martynas () ti com>
Date: Wed, 27 Sep 2006 22:20:27 +0200
Thanks for reply. Maybe I was not clear. Windows Server 2003 is acting as client and initiates connection to service on port 139 too many workstations. Actually it tries to logon as Administrator to many computers. And process, that initiates connection, is "System 4". There are no reasons why this server should connect to any of these workstations. Per configuration attempt to logon as Admin is denied. I set up open system and expect server will try to connect to it, so maybe I will understand better what is behind activity, but I am also sure, that more people got same problem for different reasons and they are willing to share their experience. So easy under Unix with LSOF and not possible under Windows ?... Can't believe! With best regards Martynas -----Original Message----- From: listbounce () securityfocus com [mailto:listbounce () securityfocus com] On Behalf Of Colin Copley Sent: Wednesday, September 27, 2006 8:55 PM To: Buozis, Martynas Cc: security-basics () securityfocus com Subject: Re: How to find process behing TCP connection ? Maybe this is some help? http://forum.sysinternals.com/forum_posts.asp?TID=3432 If not, perhaps you could attempt to telnet or putty into the port, and see if it returns an error message which might give some more info. Another idea - try ethereal to capture the packet data and see what it contains. Also I believe nmap can attempt to establish what's listening on a certain port. It might give you more info than just system 4. Regards Colin ----- Original Message ----- From: "Buozis, Martynas" <martynas () ti com> Hello I need an advice. I have Windows 2003 server. It occasionally show strange and suspicious network behavior. I used command "netstat -abov" and Process explorer tool from Sysinternals to find process behind connections. I found that it is "System 4" and got stuck. How I can identify what is behind this "System 4"? I thought it may be hidden process, but RootkitReveal from Systinternals did not show anything. I will be grateful for any ideas how to identify what is behind these TCP connections from server to many computers! Thank you in advance. With best regards Martynas ------------------------------------------------------------------------ --- This list is sponsored by: Norwich University EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE The NSA has designated Norwich University a center of Academic Excellence in Information Security. Our program offers unparalleled Infosec management education and the case study affords you unmatched consulting experience. Using interactive e-Learning technology, you can earn this esteemed degree, without disrupting your career or home life. http://www.msia.norwich.edu/secfocus ------------------------------------------------------------------------ --- --------------------------------------------------------------------------- This list is sponsored by: Norwich University EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE The NSA has designated Norwich University a center of Academic Excellence in Information Security. Our program offers unparalleled Infosec management education and the case study affords you unmatched consulting experience. Using interactive e-Learning technology, you can earn this esteemed degree, without disrupting your career or home life. http://www.msia.norwich.edu/secfocus ---------------------------------------------------------------------------
Current thread:
- Re: Best single source of current infosec news?, (continued)
- Re: Best single source of current infosec news? Ivan . (Sep 26)
- Re: Best single source of current infosec news? crazy frog crazy frog (Sep 27)
- Re: Best single source of current infosec news? krymson (Sep 26)
- Re: Best single source of current infosec news? Alexander Bolante (Sep 26)
- RE: Best single source of current infosec news? Bryan_McAninch (Sep 26)
- How to find process behing TCP connection ? Buozis, Martynas (Sep 27)
- Re: How to find process behing TCP connection ? Colin Copley (Sep 27)
- RE: How to find process behing TCP connection ? Buozis, Martynas (Sep 27)
- Re[2]: How to find process behing TCP connection ? Roman Shirokov (Sep 28)
- RE: How to find process behing TCP connection ? Simon Zuckerbraun (Sep 29)
- RE: How to find process behing TCP connection ? Buozis, Martynas (Sep 27)
- Re: How to find process behing TCP connection ? Danux (Sep 28)
- Re: How to find process behing TCP connection ? Colin Copley (Sep 28)
- RE: How to find process behing TCP connection ? Buozis, Martynas (Sep 28)
- How to find process behing TCP connection ? Buozis, Martynas (Sep 27)
- Re: How to find process behing TCP connection ? Daniel DeLeo (Sep 28)
- Re: How to find process behing TCP connection ? Mario A. Spinthiras (Sep 29)
- Re: How to find process behing TCP connection ? Daniel DeLeo (Sep 29)
- Re: Best single source of current infosec news? Ivan . (Sep 26)
- Re: How to find process behing TCP connection ? Ansgar -59cobalt- Wiechers (Sep 28)
- Re: How to find process behing TCP connection ? Mario A. Spinthiras (Sep 28)
- Re: How to find process behing TCP connection ? Ansgar -59cobalt- Wiechers (Sep 27)
- Re: How to find process behing TCP connection ? Mario A. Spinthiras (Sep 28)