Re: RE: Bizarre traffic
"Ramez Hanna" <[email protected]>
| Newsgroups | gmane.comp.security.incidents |
|---|---|
| Message-ID | <[email protected]> |
you can use netstat -naptu | grep -i established this should show you all the connection going out and you will also see which process is causing them On 23 Feb 2006 13:44:16 -0000, [email protected] <[email protected]> wrote: > I am not too sure if I can agree with you at this moment, David. It is indeed weird that traffic is only heading towards the HTTPS port. > > Have you considered running a netmon service on that source machine to see which application is actually sending out requests for HTTPS? You might be able to nail the culprit there. > > Good luck. >