----- Original Message -----
From: "Steve Armstrong" <stevearmstrong@logicallysecure.com>
To: "Buozis, Martynas" <martynas@ti.com>; "Colin Copley" <colin.75@btinternet.com>
Cc: <security-basics@securityfocus.com>
Sent: Friday, September 29, 2006 8:10 AM
Subject: RE: How to find process behing TCP connection ?
The two best tools are tcpview and process explorer. Both are by sysinternals. Tcpview will show connections and what process
is behind it, and the remote address.
Process explorer is an excellent tool that will show all processes. Hover your mouse over a listing and it will list what it
provides eg svchost! Very cool. You can also look at what port, remote connection, memory and resources are being used. You can
even look at the strings in the file.
Get these two and burn them to a cdrom - they make a great incident
identification tool kit.
Also given the @stake tool posting yesterday, get these now, as microsoft has bought sysinternals so the day will come where
these are either not free nor not available.
I have downloaded all the sysinternals tools and will post a link to the
complete zip in the next few days.
Hope this is of use to you.
Steve A
This one is also worth a look (free for non-commercial use), and has
'snapshot' capabilities:
http://www.whatsrunning.net/whatsrunning/Screenshots.aspx
--Michael
---------------------------------------------------------------------------
This list is sponsored by: Norwich University
EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The NSA has designated Norwich University a center of Academic Excellence
in Information Security. Our program offers unparalleled Infosec management
education and the case study affords you unmatched consulting experience.
Using interactive e-Learning technology, you can earn this esteemed degree,
without disrupting your career or home life.
http://www.msia.norwich.edu/secfocus
---------------------------------------------------------------------------
