RE: How to find process behing TCP connection ?

["Buozis, Martynas" <martynas () ti com>]

Sorry, but I probably was not clear in my explanation. Problem is that
Windows 2003 server is acting as client in my case. Windows Server is
initiating session to port 139 to different workstations on the net. It
actually tries to login to many workstations on different local subnets
as user Administrator (logon is denied). I want understand which process
behind "System 4" initiates this scan to many computers with attempt to
logon as Admin user.

I can bet that there must be people who already were trying to find
process behind "System 4" and I will appreciate if somebody will share
his/her experience.

I already set up an open system and wait till it hit it's IP to
understand what will follow upon successful logon. But I expect that
there must be a way how to find under Windows what is behind connection.
So easy with lsof under Unix, looks like impossible under Windows?...

Thanks.


With best regards
Martynas 

-----Original Message-----
From: Colin Copley [mailto:colin.75 () btinternet com] 
Sent: Wednesday, September 27, 2006 8:55 PM
To: Buozis, Martynas
Cc: security-basics () securityfocus com
Subject: Re: How to find process behing TCP connection ?

Maybe this is some help?

http://forum.sysinternals.com/forum_posts.asp?TID=3432

If not, perhaps you could attempt to telnet or putty into the port, and
see
if it returns an error message which might give some more info.
Another idea - try ethereal to capture the packet data and see what it
contains.
Also I believe nmap can attempt to establish what's listening on a
certain
port.  It might give you more info than just system 4.
Regards
Colin


----- Original Message ----- 
From: "Buozis, Martynas" <martynas () ti com>
Hello

I need an advice. I have Windows 2003 server. It occasionally show
strange and suspicious network behavior. I used command "netstat -abov"
and Process explorer tool from Sysinternals to find process behind
connections. I found that it is "System 4" and got stuck. How I can
identify what is behind this "System 4"?

I thought it may be hidden process, but RootkitReveal from Systinternals
did not show anything.

I will be grateful for any ideas how to identify what is behind these
TCP connections from server to many computers!

Thank you in advance.

With best regards
Martynas



---------------------------------------------------------------------------
This list is sponsored by: Norwich University

EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The NSA has designated Norwich University a center of Academic Excellence
in Information Security. Our program offers unparalleled Infosec management
education and the case study affords you unmatched consulting experience.
Using interactive e-Learning technology, you can earn this esteemed degree,
without disrupting your career or home life.

http://www.msia.norwich.edu/secfocus
---------------------------------------------------------------------------