Detect app that opens network connection

[amoroder]

Hello,

according to our firewall a application on our terminal server tries
to open a network connection to a address it should not.
Now I want to know what application opens this connection. I tried
with netstat and with sysinternal's tcpview but I did not find
anything. Probably the applications opens the connection only at
certain intervals and closes it immediately.

Can anyone please tell me how I can find the culprit ?

Thanks
Andreas

 

[John John]

That is where a software firewall is handy to have. It can be turned on
and off as needed. As you use it you allow your trusted applications
through, the firewall will give you a pop-up when any "non trusted"
applications attempt to make connections and the pop up will stay up
until you acknowledge it.

John

 

[amoroder]

That is where a software firewall is handy to have. It can be turned on
and off as needed. As you use it you allow your trusted applications
through, the firewall will give you a pop-up when any "non trusted"
applications attempt to make connections and the pop up will stay up
until you acknowledge it.

John

Hello John,

but this is a production terminal server in a hospital. I can not
immagine to play around with a software firewall that asks the users
if this connection is ok or not.

Bye
Andreas

 

[Richard G. Harper]

Don't bother. In a setting where confidential data is present, nuke the box
and rebuild it from scratch.

--
Richard G. Harper [MVP Shell/User] (e-mail address removed)
* NEW! Catch my blog ... http://msmvps.com/blogs/rgharper/
* PLEASE post all messages and replies in the newsgroups
* The Website - http://rgharper.mvps.org/
* HELP us help YOU ... http://www.dts-l.org/goodpost.htm