RE: How to find a program opening ports on your XP Machine , 2000 etc

Click start run and type CMD press return
type netstat -ao
notice the end column says PID then the list of numbers.
Next right click the time on the bottom right hand corner of your screen and 
click Task Manager

then in the menu at the top click View Select Columns then tick the box that 
says PID and click ok.

you will then see a column has appeared that says PID and displays the 
Process Id Number.

Simply look at the DOS command window where you ran the Netstat -ao select 
any of the PID
numbers from that and then open the taskmanager to match up which program is 
opening ports.
And there you have your very own method of checking port access on your 
machine , so you dont have to buy those expensive programs.



>From: [email protected]
>Reply-To: [email protected]
>To: [email protected]
>Subject: Intrusions Digest, Vol 5, Issue 49
>Date: Sat, 28 Aug 2004 12:00:11 GMT
>
>Send Intrusions mailing list submissions to
>	[email protected]
>
>To subscribe or unsubscribe via the World Wide Web, visit
>	http://www.dshield.org/mailman/listinfo/intrusions
>or, via email, send a message with subject or body 'help' to
>	[email protected]
>
>You can reach the person managing the list at
>	[email protected]
>
>When replying, please edit your Subject line so it is more specific
>than "Re: Contents of Intrusions digest..."
>
>
>Today's Topics:
>
>    1. Re: Strange echo requests from 127.0.0.1 apparently	to	root
>       nameservers (Steve Williamson)
>    2. Re: Strange echo requests from 127.0.0.1 apparently to	root
>       nameservers ([email protected])
>
>
>----------------------------------------------------------------------
>
>Message: 1
>Date: Fri, 27 Aug 2004 15:19:06 -0500
>From: Steve Williamson <[email protected]>
>Subject: Re: [Intrusions] Strange echo requests from 127.0.0.1
>	apparently	to	root nameservers
>To: "Intrusions List (GCIA Practicals)" <[email protected]>
>Message-ID: <[email protected]>
>Content-Type: text/plain; charset=ISO-8859-1; format=flowed
>
>A utility from Foundstone, fport (www.foundstone.com -> resources ->free
>tools) may help you find the program generating the traffic.  It maps
>port activity to a running application.
>
>hth
>Steve
>
>Terje Trane wrote:
>
> >I tried to troubleshoot a PC that all of a sudden would connect but not
> >route traffic to a remote site by VPN and started Ethereal to see if I 
>could
> >see where the packets were going.
> >
> >To my surprise I can see a dozen ICMP echo request packets per second 
>sent
> >from 127.0.0.1. Every other is to my internal DNS-servers, and the rest
> >(except for a few) to *.root-servers.net and *.gtld-servers.net.
> >
> >My thought was that this is malware scanning or trying a DoS on the DNS,
> >though AV is up to date and running. However, the firewall technician 
>says
> >he cannot see this traffic at the firewall. I tried using tcpdump on an
> >other machine on the same hub and cannot see this traffic, so I guess it
> >must be local?
> >
> >By looking at the MAC-addresses i see that all packets are from
> >08:00:2b:00:dc:dc which is not the MAC address of the local PC and 
>completly
> >unknown to me, and they are sent to 08:00:2b:00:01:02 which is also 
>unknown.
> >08:00:2b is the vendor code for DEC and we have no DEC equipment here.
> >
> >I tried killing the processes I don't know on this PC, but not all will 
>die.
> >Is there any way in Windows I can see what process is generating what 
>TCP/IP
> >traffic?
> >
> >And most important: What can this be?
> >
> >
> >_______________________________________________
> >Intrusions mailing list
> >[email protected]
> >http://www.dshield.org/mailman/listinfo/intrusions
> >
> >
> >
> >
>
>
>
>
>------------------------------
>
>Message: 2
>Date: Fri, 27 Aug 2004 16:31:30 -0400 (EDT)
>From: [email protected]
>Subject: Re: [Intrusions] Strange echo requests from 127.0.0.1
>	apparently to	root nameservers
>To: [email protected]
>Message-ID: <[email protected]>
>Content-Type: text/plain; charset=ISO-8859-1
>
>Foundstone has a tool, fport, which will "Identify unknown open ports and 
>their
>associated applications."
>
>http://www.foundstone.com
>
>Sorry, don't have a direct link to the tool but follow this path:
>» Home > Resources > Free Tools
>
>
>Quoting Terje Trane <[email protected]>:
>
> >
> > I tried to troubleshoot a PC that all of a sudden would connect but
> > not
> > route traffic to a remote site by VPN and started Ethereal to see if I
> > could
> > see where the packets were going.
> >
> > To my surprise I can see a dozen ICMP echo request packets per second
> > sent
> > from 127.0.0.1. Every other is to my internal DNS-servers, and the
> > rest
> > (except for a few) to *.root-servers.net and *.gtld-servers.net.
> >
> > My thought was that this is malware scanning or trying a DoS on the
> > DNS,
> > though AV is up to date and running. However, the firewall technician
> > says
> > he cannot see this traffic at the firewall. I tried using tcpdump on
> > an
> > other machine on the same hub and cannot see this traffic, so I guess
> > it
> > must be local?
> >
> > By looking at the MAC-addresses i see that all packets are from
> > 08:00:2b:00:dc:dc which is not the MAC address of the local PC and
> > completly
> > unknown to me, and they are sent to 08:00:2b:00:01:02 which is also
> > unknown.
> > 08:00:2b is the vendor code for DEC and we have no DEC equipment here.
> >
> > I tried killing the processes I don't know on this PC, but not all will
> > die.
> > Is there any way in Windows I can see what process is generating what
> > TCP/IP
> > traffic?
> >
> > And most important: What can this be?
> >
> >
> > _______________________________________________
> > Intrusions mailing list
> > [email protected]
> > http://www.dshield.org/mailman/listinfo/intrusions
> >
>
>
>
>------------------------------
>
>_______________________________________________
>Intrusions mailing list
>[email protected]
>http://www.dshield.org/mailman/listinfo/intrusions
>
>
>End of Intrusions Digest, Vol 5, Issue 49
>*****************************************

_________________________________________________________________
Express yourself with cool new emoticons http://www.msn.co.uk/specials/myemo

_______________________________________________
Intrusions mailing list
[email protected]
http://www.dshield.org/mailman/listinfo/intrusions