General discussion

Locked

IP port monitor

By M.R. ·
I have a firewall complaining that an address in the
169.254.x.x auto-assign range is trying to be accessed by our proxy
server. The specific port keeps incrementing throughout
the day. It only occurs during business hours but I can't
seem to associate with an individual workstation coming
online. I'm not aware of Proxy using this address but
port usage of this type could be normal. Is there a way
to have the server log what app or other service is trying
to make that connection? NETSTAT, etc? If it's found to
be proxy then I'll need to figure out why. None of the
proxy logs show this address or show anything being
accessed at these particular moments.

Thanks

This conversation is currently closed to new comments.

4 total posts (Page 1 of 1)  
| Thread display: Collapse - | Expand +

All Comments

Collapse -

IP port monitor

by M.R. In reply to IP port monitor

Point value changed by question poster.

Collapse -

IP port monitor

by Tictag In reply to IP port monitor

I have limited experience in this but you could try using Network Monitor to filtered-capture the packets coming into the proxy server, filtered for the auto-range IP addresses. Review the capture and identify the MAC / Ethernet / Physical address of the offending packets.

You could then search for the MAC address using, for example, the WINS or DHCP management tools to find the offending client.

Strangely, I can not think of a single tool that specifically polls a MAC address although this is what the Address Resolution Protocol (ARP) actually does. Anyone?

Using Network Monitor to capture a ping to the Auto-assigned IP address should also reveal the MAC address of the client.

Regards,
Tictag.

Collapse -

IP port monitor

by M.R. In reply to IP port monitor

I don't beleive I have a client within that address range (at least it can't be PINGed). It's a client requesting that address on various ports. It could also be the PROXY doing it at times when the Inet is being requested. NetMon might help but would have to be looked at from a Proxy packet angle.

Collapse -

by M.R. In reply to IP port monitor

This question was closed by the author

Back to Windows Forum
4 total posts (Page 1 of 1)  

Related Discussions

Related Forums