Networks

Ask something
Question Locked

How to find UDP processes?

0 helpful
5 replies

by thchan

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hi,

I was trying to nail down which process in one of our server is sending the UDP1035/1036 to some external addresses but to no avail. I can see the traffics are blocked at the firewall and can capture it with wireshark but I can't tell which process is sending the UDP traffic.

Both TCPView and CurrPort doesn't show anything at all on UDP.

Server info:
Windows Server 2003 SP2
Domain Controller
Source port: random
Destination port: UDP1035/1036/1045/1046

Any help and suggestion will be much appreciated.

5 replies

by larbakium

You can give it a go on CurrPorts 1.32. It's free for download and might do the trick.

Try it to see if tells you what you need.

by thchan

I have tried that at the first place but CurrPort doesn't show any outgoing UDP traffics. It only show listening UDP ports.

Cheers.

by mafergus

Normally 1035 and 1036 can be part of m$ RPC process, but in a normal environment, those shouldn't be brodcasting out to the internet.
That range can be dynamically assigned and there are several trojans/rootkits that use that range also. I would run netstat on the affected server to track down the process. As a precaution, I would also run a rootkit scanner.

by thchan

Nope, netstat doesn't show the outgoing UDP traffics either.

I don't suppose the server is compromised in anyway, it's most probably just misconfigured by the server admin. But now she said she have no idea what to do with the misconfigured machine/traffics, so I have to clean up for her.

This discussion is closed to new replies.