Re: How to find a process

"netstat -lp" will show all ports in the listening state and the PID
of the process listening on that port. Read the man page for netstat
and you will see you can do alot more, and just view UDP or TCP
connections.

On 6/13/07, Francisco Rodrigo Cortinas Maseda
<francisco.cortinas@xxxxxxxxxxx> wrote:
Hello,

my name is Fran, im a network and system administrator, and i have a
strange case, but sure somenone have had the same problem before me.

My problem is that we have some strange traffic on the firewalls, going
from a server on a DMZ to public client pools.

10:09:10.511978 00:0e:0c:71:7f:cd > 10:00:00:00:26:01, ethertype IPv4
(0x0800), length 61: IP XXXXX.44267 > XXXXXX.3072: UDP, length 19

The problem is: with netstat i only see the ports daemons are listening
on. I want to know the process that is using the outgoing port, that is,
44267.

Is there a way to know this?

Thanks in advance.
Regards.




--
- Justin Lintz

Relevant Pages

  • Re: Win2k Netstat sockets interpretation
    ... I have deleted "file and print sharing" under "internet connections and disbled most recognizable "remote access" services under 'services.msc' but ZA detects a few remote access modules running and gives them permission if select "OK" to the suggested query. ... notice randomly ports assigned to urls or ip addresss. ... 'netstat' on Win2K provides a view on the state of the *TDI interface*, ... something appearing as 0.0.0.0 listening means "an outstanding request to ...
    (alt.computer.security)
  • Re: ServU-deamon trojan warning with McAfee
    ... This PLAIN and SIMPLE shouldn't happen in an ISA controlled ... A NETSTAT can reveal some information, ... listening on that port and passes 'normal' traffic to my SMTP but also ... > only needed TCP ports listening. ...
    (microsoft.public.backoffice.smallbiz2000)
  • Re: Firewalls offer no REAL outbound protection????
    ... At least, on my Win2K ... There is a known bug in Win2K netstat, showing ports as "listening" ...
    (comp.security.firewalls)
  • Re: DCOM Listening Ports
    ... | I do a netstat -an and I have several ports related to DCOM ... Ports 1025 and 1027 particularly. ... shown as 'listening' in netstat despite tightening up your ... You will find that disabling the service Task Scheduler will ...
    (comp.security.misc)
  • Re: ksh - Cannot open /dev/tcp/host/port
    ... You can only connect to ports where there's something listening. ... If you don't have any process listening on port 13 on the ... I've never seen it enabled in any ksh93 command. ...
    (comp.unix.shell)