RE: How to detect which application is sending out packet?

From: Kowalski, Thomas TL26C <Thomas.Kowalski(at)CIGNA.COM>
Date: Thu Dec 12 2002 - 11:58:52 EST

http://www.sysinternals.com/ntw2k/utilities.shtml

Download the product called "TCPView"

Thomas Kowalski, Security Compliance Officer Group Insurance Systems, Application Development Support Routing TL26C

215.761.8872 (phone)
609.254.2138 (cell) 
215.761.5618 (fax)

thomas.kowalski@cigna.com

"SCIENTIA EST POTENTIA" Confidential, unpublished property of CIGNA. Do not duplicate or distribute.
Use and distribution limited solely to authorized personnel. (c) Copyright 2002 (CIGNA)

-----Original Message-----

From: John Li [mailto:jli@to.epost.ca]
Sent: Wednesday, December 11, 2002 8:50 PM To: 'forensics@securityfocus.com'
Subject: How to detect which application is sending out packet?

After I captured some interesting packets from one box continuously, how can I know which application is sending out those packets. Is there any monitoring software can tell you that?

The box is a windows 2k server and has regular services on it.

Thanks.

John

---

This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com

---

CONFIDENTIALITY NOTICE: If you have received this e-mail in error, please immediately notify the sender by e-mail at the address shown. This e-mail transmission may contain confidential information. This information is intended only for the use of the individual(s) or entity to whom it is intended even if addressed incorrectly. Please delete it from your files if you are not the intended recipient. Thank you for your compliance. Copyright (c) 2002 CIGNA

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


-----------------------------------------------------------------

This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com Received on Thu Dec 12 12:09:00 2002