Networks

Ask something
Question Locked

TCP connections

0 helpful
12 replies

by joe11701

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Server A is connecting and sending traffic to server B.
They should not be talking to each other.
I'd like to find out what process is being used to do this and disable / terminate it.

Server A is Win2K server
Server B is Win2k3

Any ideas?

12 replies

by curlergirl

Are they on the same TCP/IP subnet? If so, basic network browsing traffic would cause some instances where the two servers would contact each other. The only way to prevent this would be to turn off the computer browser service, which would prevent ALL connections (not just the ones from the specific server).

by joe11701

They are NOT on the same subnet.
and the Computer Browser server is disabled.

by silveradocyn

Your question is so vague that there is no way to tell what you are asking. Http traffic, Printer Traffic, File Server Traffic... How do you know that the server is forwarding the traffic and there isn't confusion in the naming? There are multiple levels that you could be asking about, and starting with a real description is the first step.

by joe11701

My apologies, but i don't know what kind of traffic is being sent. i would think that if i knew that, i'd know where it was coming from.

by zen37

The port number should give you a nice idea of which service or application is communicating. If not, look inside the packet, there could be clues there.

by joe11701

According to netstat, the port number is 3511....
and this is for?????.....

by zen37

3511 sounds like a source port number, the destination should be under 1024. If not, then this is probably not a Windows service

by lowlands

run netstat on both servers.

on server A, look for IP of server B and other way around.

On server B, try netstat -ano, search for both server A's IP and on server A the associated process ID.

by joe11701

There's a difference in versions of netstat between the 2 boxes. the -o switch doesn't exist on Server A ( win 2000)

I'll try to copy it over.

by stress junkie

There is an excellent application called Ethereal that does a great job of displaying network traffic. Ethereal is free.

www.ethereal.com

When you start the application go to the options, then click on "update display in real time", then click on "OK". You will see the network traffic displayed immediately and you can store it in a file.

This discussion is closed to new replies.