RE: RE: How to find a program opening ports on your XPMachine , 2000 etc

"Bill Royds" <[email protected]>
Newsgroups gmane.comp.security.intrusions
Message-ID <[email protected]> 
Windows XP makes this much easier
The netstat command has options -b so that 
Netstat -aob 

Gives the name and path of the process using each port as well as process ID.

C:\> netstat -aob
Active Connections

  Proto  Local Address          Foreign Address        State           PID

  TCP    Bill-Dell:epmap        Bill-Dell:0            LISTENING       736
  c:\windows\system32\WS2_32.dll
  C:\WINDOWS\system32\RPCRT4.dll
  c:\windows\system32\rpcss.dll
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\ADVAPI32.dll
  [svchost.exe]


  TCP    Bill-Dell:microsoft-ds  Bill-Dell:0            LISTENING       4
  [System]

 
  TCP    Bill-Dell:1468         Bill-Dell:0            LISTENING       1304
  [Syslogd_Service.exe]

  TCP    Bill-Dell:3300         Bill-Dell:0            LISTENING       1304
  [Syslogd_Service.exe]

-----Original Message-----
From: [email protected]
[mailto:[email protected]] On Behalf Of lee forrest
Sent: Saturday, August 28, 2004 12:06 PM
To: [email protected]
Subject: [Intrusions] RE: How to find a program opening ports on your XPMachine
, 2000 etc

Click start run and type CMD press return
type netstat -ao
notice the end column says PID then the list of numbers.
Next right click the time on the bottom right hand corner of your screen and 
click Task Manager

then in the menu at the top click View Select Columns then tick the box that 
says PID and click ok.

you will then see a column has appeared that says PID and displays the 
Process Id Number.

Simply look at the DOS command window where you ran the Netstat -ao select 
any of the PID
numbers from that and then open the taskmanager to match up which program is 
opening ports.
And there you have your very own method of checking port access on your 
machine , so you dont have to buy those expensive programs.



>From: [email protected]
>Reply-To: [email protected]
>To: [email protected]
>Subject: Intrusions Digest, Vol 5, Issue 49
>Date: Sat, 28 Aug 2004 12:00:11 GMT
>
>Send Intrusions mailing list submissions to
>	[email protected]
>
>To subscribe or unsubscribe via the World Wide Web, visit
>	http://www.dshield.org/mailman/listinfo/intrusions
>or, via email, send a message with subject or body 'help' to
>	[email protected]
>
>You can reach the person managing the list at
>	[email protected]
>
>When replying, please edit your Subject line so it is more specific
>than "Re: Contents of Intrusions digest..."
>
>
>Today's Topics:
>
>    1. Re: Strange echo requests from 127.0.0.1 apparently	to	root
>       nameservers (Steve Williamson)
>    2. Re: Strange echo requests from 127.0.0.1 apparently to	root
>       nameservers ([email protected])
>
>
>----------------------------------------------------------------------
>
>Message: 1
>Date: Fri, 27 Aug 2004 15:19:06 -0500
>From: Steve Williamson <[email protected]>
>Subject: Re: [Intrusions] Strange echo requests from 127.0.0.1
>	apparently	to	root nameservers
>To: "Intrusions List (GCIA Practicals)" <[email protected]>
>Message-ID: <[email protected]>
>Content-Type: text/plain; charset=ISO-8859-1; format=flowed
>
>A utility from Foundstone, fport (www.foundstone.com -> resources ->free
>tools) may help you find the program generating the traffic.  It maps
>port activity to a running application.
>
>hth
>Steve
>
>Terje Trane wrote:
>
> >I tried to troubleshoot a PC that all of a sudden would connect but not
> >route traffic to a remote site by VPN and started Ethereal to see if I 
>could
> >see where the packets were going.
> >
> >To my surprise I can see a dozen ICMP echo request packets per second 
>sent
> >from 127.0.0.1. Every other is to my internal DNS-servers, and the rest
> >(except for a few) to *.root-servers.net and *.gtld-servers.net.
> >
> >My thought was that this is malware scanning or trying a DoS on the DNS,
> >though AV is up to date and running. However, the firewall technician 
>says
> >he cannot see this traffic at the firewall. I tried using tcpdump on an
> >other machine on the same hub and cannot see this traffic, so I guess it
> >must be local?
> >
> >By looking at the MAC-addresses i see that all packets are from
> >08:00:2b:00:dc:dc which is not the MAC address of the local PC and 
>completly
> >unknown to me, and they are sent to 08:00:2b:00:01:02 which is also 
>unknown.
> >08:00:2b is the vendor code for DEC and we have no DEC equipment here.
> >
> >I tried killing the processes I don't know on this PC, but not all will 
>die.
> >Is there any way in Windows I can see what process is generating what 
>TCP/IP
> >traffic?
> >
> >And most important: What can this be?
> >
> >
> >_______________________________________________
> >Intrusions mailing list
> >[email protected]
> >http://www.dshield.org/mailman/listinfo/intrusions
> >
> >
> >
> >
>
>
>
>
>------------------------------
>
>Message: 2
>Date: Fri, 27 Aug 2004 16:31:30 -0400 (EDT)
>From: [email protected]
>Subject: Re: [Intrusions] Strange echo requests from 127.0.0.1
>	apparently to	root nameservers
>To: [email protected]
>Message-ID: <[email protected]>
>Content-Type: text/plain; charset=ISO-8859-1
>
>Foundstone has a tool, fport, which will "Identify unknown open ports and 
>their
>associated applications."
>
>http://www.foundstone.com
>
>Sorry, don't have a direct link to the tool but follow this path:
>> Home > Resources > Free Tools
>
>
>Quoting Terje Trane <[email protected]>:
>
> >
> > I tried to troubleshoot a PC that all of a sudden would connect but
> > not
> > route traffic to a remote site by VPN and started Ethereal to see if I
> > could
> > see where the packets were going.
> >
> > To my surprise I can see a dozen ICMP echo request packets per second
> > sent
> > from 127.0.0.1. Every other is to my internal DNS-servers, and the
> > rest
> > (except for a few) to *.root-servers.net and *.gtld-servers.net.
> >
> > My thought was that this is malware scanning or trying a DoS on the
> > DNS,
> > though AV is up to date and running. However, the firewall technician
> > says
> > he cannot see this traffic at the firewall. I tried using tcpdump on
> > an
> > other machine on the same hub and cannot see this traffic, so I guess
> > it
> > must be local?
> >
> > By looking at the MAC-addresses i see that all packets are from
> > 08:00:2b:00:dc:dc which is not the MAC address of the local PC and
> > completly
> > unknown to me, and they are sent to 08:00:2b:00:01:02 which is also
> > unknown.
> > 08:00:2b is the vendor code for DEC and we have no DEC equipment here.
> >
> > I tried killing the processes I don't know on this PC, but not all will
> > die.
> > Is there any way in Windows I can see what process is generating what
> > TCP/IP
> > traffic?
> >
> > And most important: What can this be?
> >
> >
> > _______________________________________________
> > Intrusions mailing list
> > [email protected]
> > http://www.dshield.org/mailman/listinfo/intrusions
> >
>
>
>
>------------------------------
>
>_______________________________________________
>Intrusions mailing list
>[email protected]
>http://www.dshield.org/mailman/listinfo/intrusions
>
>
>End of Intrusions Digest, Vol 5, Issue 49
>*****************************************

_________________________________________________________________
Express yourself with cool new emoticons http://www.msn.co.uk/specials/myemo

_______________________________________________
Intrusions mailing list
[email protected]
http://www.dshield.org/mailman/listinfo/intrusions

_______________________________________________
Intrusions mailing list
[email protected]
http://www.dshield.org/mailman/listinfo/intrusions
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.