Re: http connection

Hmmm

For a second I thought PortReporter might help, but not having
used it on W2k I reviewed the info
http://support.microsoft.com/kb/837243
and it appears it will not provide the needed info on specific
modules within the PID either.

It is pretty surprising how much exists about unknown.level3.net
on the net without there actually being any info about it.
DNS shows it is just an alias for www.level3.com but it surely
behaves differently when the hostheader is not www.level3.net


"Al Smith" <ascssmith@xxxxxxxxx> wrote in message
news:%23sHNapkEHHA.5028@xxxxxxxxxxxxxxxxxxxxxxx
ran program, all it says is SYSTEM 8, which also runs outlook and dns...
thanks anyway...

AL


"Danny Sanders" <DSanders@xxxxxxxxxxxxxxx> wrote in message
news:%23wN$MYkEHHA.4620@xxxxxxxxxxxxxxxxxxxxxxx
See:
http://www.microsoft.com/technet/sysinternals/utilities/TcpView.mspx


hth
DDS
"Al Smith" <ascssmith@xxxxxxxxx> wrote in message
news:uQIBbRkEHHA.4928@xxxxxxxxxxxxxxxxxxxxxxx
we have anti-virus on ALL pc's. I wish these pc's were xp, versus 2000.
as with netstat on xp you can use -b and it will tell you what service
is running on http. does anyone know a way around this with win2000?

AL

"Danny Sanders" <DSanders@xxxxxxxxxxxxxxx> wrote in message
news:%23iIjw4jEHHA.4280@xxxxxxxxxxxxxxxxxxxxxxx
My mistake,

I thought they were coming from the outside trying to get in.

If they are coming from the inside you need a to get a virus software
installed on the machines sending these packets. Adware/Spyware would
not be out of the question.


hth
DDS

"Roger Abell [MVP]" <mvpNoSpam@xxxxxxx> wrote in message
news:un2cooxDHHA.4620@xxxxxxxxxxxxxxxxxxxxxxx
"Danny Sanders" <DSanders@xxxxxxxxxxxxxxx> wrote in message
news:eLwp12lDHHA.4956@xxxxxxxxxxxxxxxxxxxxxxx
to tell me what it
is, and how to stop it. all attempts are dropped by firewall, but
this continually happens.

You really can't stop them from knocking but you can stop them from
getting in, which is what happens when the firewall drops the
connection.

Be more concerned with what is getting in.


But Danny, the post is about outbound activity.


"Al Smith" <ascssmith@xxxxxxxxx> wrote in message
news:OYnVxzkDHHA.4808@xxxxxxxxxxxxxxxxxxxxxxx
ok, need some direction here, I have (108) stores that are connected
through a wan, that has a private address scheme. none of them are
allowed to go out to the internet. all connections go through
checkpoint FW1. I have numerous connections through the day trying
to connect from each store pc (windows 2000 professional) to
unknown.level3.net port 2920 and 2938.

Googling web, I found all kinds of items, that are way out there...
:)

but what I need is for someone that has dealt with this, to tell me
what it is, and how to stop it. all attempts are dropped by
firewall, but this continually happens.

Thanks in advance

AL















.

Relevant Pages

  • Re: http connection
    ... For a second I thought PortReporter might help, ... I have numerous connections through the day ... firewall, but this continually happens. ...
    (microsoft.public.win2000.security)
  • Re: http connection
    ... as with netstat on xp you can use -b and it will tell you what service is ... which is what happens when the firewall drops the ... I have numerous connections through the day trying to ...
    (microsoft.public.win2000.security)
  • Re: http connection
    ... running on http. ... which is what happens when the firewall drops the ... I have numerous connections through the day trying to ...
    (microsoft.public.win2000.security)
  • Re: http connection
    ... running on http. ... which is what happens when the firewall drops the ... I have numerous connections through the day trying to ...
    (microsoft.public.win2000.security)
  • Re: What is the Pattern here ?
    ... These are all Dialup Connections that I had no connection with at the time. ... It's obviously an enormous security hole, ... > and a real firewall box. ...
    (comp.security.firewalls)