identifying the source of suspicous outgoing network traffic

identifying the source of suspicous outgoing network traffic
Secure Home | Search | About
Login Password
Register Now! Lost Password?
 Computer Software Security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
identifying the source of suspicous outgoing network traffic dave 10-22-2006
Posted by dave on October 22, 2006, 4:32 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
I decided to block and log all outgoing
network traffic from my win2k computer
(192.168.1.13) using my Linux based firewall (iptables)
and am getting a lot of entries which look like

Oct 22 13:09:34 IN=eth1 OUT=eth0 SRC=192.168.1.13 DST=81.105.6.18
LEN=142 TOS=0x00 PREC=0x00 TTL=127 ID=38884 PROTO=UDP SPT=49038
DPT=43184 LEN=122

My question is: Can I identify the processes on my win2k box
which are generating these attempts to communicate.

Thanks,

Dave

Posted by Sebastian Gottschalk on October 22, 2006, 6:23 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
dave wrote:

> My question is: Can I identify the processes on my win2k box
> which are generating these attempts to communicate.

netstat -ano

Posted by dave on October 22, 2006, 6:42 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Sebastian Gottschalk wrote:
> dave wrote:
>
>> My question is: Can I identify the processes on my win2k box
>> which are generating these attempts to communicate.
>
> netstat -ano

>

Thanks for the reply. I had already looked at netstat on my win2k box
but it does not identify the process which is associated with the port
being open. This netstat does not seem to accept the "o" option.
netstat -ano just displays the help screen and netsat -an
only displays

TCP 0.0.0.0:49038 0.0.0.0:0 LISTENING
UDP 0.0.0.0:49038 *:*

for example which was associated with my iptables log for that port.


Oct 22 13:09:34 IN=eth1 OUT=eth0 SRC=192.168.1.13 DST=81.105.6.18
LEN=142 TOS=0x00 PREC=0x00 TTL=127 ID=38884 PROTO=UDP SPT=49038
DPT=43184 LEN=122

Dave






Posted by Jim Watt on October 22, 2006, 8:44 pm
If you were  Registered and logged in, you could reply and use other advanced thread options

>Sebastian Gottschalk wrote:
>> dave wrote:
>>
>>> My question is: Can I identify the processes on my win2k box
>>> which are generating these attempts to communicate.
>>
>> netstat -ano
>
>>
>
>Thanks for the reply. I had already looked at netstat on my win2k box
>but it does not identify the process which is associated with the port
>being open. This netstat does not seem to accept the "o" option.
>netstat -ano just displays the help screen and netsat -an
>only displays
>
> TCP 0.0.0.0:49038 0.0.0.0:0 LISTENING
> UDP 0.0.0.0:49038 *:*
>
>for example which was associated with my iptables log for that port.
>
>
>Oct 22 13:09:34 IN=eth1 OUT=eth0 SRC=192.168.1.13 DST=81.105.6.18
>LEN=142 TOS=0x00 PREC=0x00 TTL=127 ID=38884 PROTO=UDP SPT=49038
>DPT=43184 LEN=122


Get process monitor from sysinternals (freeware)

www.sysinternals.com/Utilities/ProcessExplorer.html

It will tell.

--
Jim Watt
http://www.gibnet.com

Posted by dave on October 22, 2006, 11:02 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Jim Watt wrote:
>
>> Sebastian Gottschalk wrote:
>>> dave wrote:
>>>
>>>> My question is: Can I identify the processes on my win2k box
>>>> which are generating these attempts to communicate.
>>> netstat -ano
>> Thanks for the reply. I had already looked at netstat on my win2k box
>> but it does not identify the process which is associated with the port
>> being open. This netstat does not seem to accept the "o" option.
>> netstat -ano just displays the help screen and netsat -an
>> only displays
>>
>> TCP 0.0.0.0:49038 0.0.0.0:0 LISTENING
>> UDP 0.0.0.0:49038 *:*
>>
>> for example which was associated with my iptables log for that port.
>>
>>
>> Oct 22 13:09:34 IN=eth1 OUT=eth0 SRC=192.168.1.13 DST=81.105.6.18
>> LEN=142 TOS=0x00 PREC=0x00 TTL=127 ID=38884 PROTO=UDP SPT=49038
>> DPT=43184 LEN=122
>
>
> Get process monitor from sysinternals (freeware)
>
> www.sysinternals.com/Utilities/ProcessExplorer.html
>
> It will tell.
>
> --
> Jim Watt
> http://www.gibnet.com
Thanks,

I installed it and it is a good beginning.

Dave

Similar ThreadsPosted
unknown outgoing tcp traffic - should I be worried? November 8, 2007, 4:39 pm
Identifying Apps By Port December 18, 2006, 3:20 pm
Can't Turn Off NAV Outgoing E-mail Scanning June 25, 2005, 2:13 pm
Public Wireless Network together with Private Wireless Network November 15, 2007, 3:39 am
Source Port 10000 March 10, 2006, 9:39 am
Japan & China going Open Source... October 6, 2005, 11:58 pm
Open Source Taking Over Europe October 21, 2005, 10:36 pm
open source encryption software April 14, 2006, 9:39 am
Oregon State Gov is supporting Open Source... August 18, 2005, 4:37 am
Massachusetts is migrating to open-source software September 7, 2005, 2:46 am

The site map in XML format XML site map

Contact Us | Privacy Policy