How do I work out who connects to what application?

[Bernard46]

I have Win 7 Home Premium and I run Netgadget which tells me amongst other things what active connections there are on my system at the moment. I have often been curious about this information and wondered about how legitimate some of these connections are.

For instance right now I have a connection established to IP address 62.103.65.80 and netGadget says this is "dulac--r.static.otenet.gr". If I do a Whois search on the IP address I'm told it belongs to OTENET who are "Multiprotocol Service Provider to other ISP's and End Users located in Greece and having nodes in 63 cities".

Now I have no reason to believe this isn't a genuine site, but to the best of my knowledge there is no reason why I should have any connection right now to a site in Greece. I have my Hotmail account open and 2 IE tabs open to WHOIS and this forum. In addition I have several other gadgets open to the BBC, the UK Met office, Airmiles (a UK rewards company) and Skype.

So my question is does anyone know how I might track down which application on my system is holding the connection to the OTENET user?

By the way whilst I was writing this entry the Greek connection went away and I now see I have a connection to a site in Russia (83.149.3.64 ip-83-149-3-64.nwgsm.ru on port 57104) - I'm getting quite worried (paranoid, even) about these even though I have a good firewall etc all up to date.

 

[Jacee]

Nwgsm.ru - Nw Gsm
Are you downloading anything? It could also be just a cyberspace ping.

 

[chev65]

Wireshark is pretty good at this sorta thing.
Wireshark Go deep.

 

[dmex]

So my question is does anyone know how I might track down which application on my system is holding the connection to the OTENET user?

Hi Bernard,

A tool I develop called Process Hacker should do exactly what you need, You can grab it from here: http://www.sevenforums.com/projects/18338-processhacker.html

Just click the network tab to view all processes network activity, you can also right-click a connection and ping/tracert/whois the connection directly from PH.
If you spot any processes with suspicious network connections, right-click them on the Processes tab and goto Miscellaneous > Upload to VirusTotal and have that executable scanned by over 30 different anti-virus engines

(FYI: The latest versions don't have four tabs, this does since Im working on a new interface )



Hope it helps

Steven

 

[Bernard46]

Fantastic

That's a great tool Steven - just what I needed and way beyond what I was expecting. You have yourself a donation - not a lot, but enough to buy yourself a beer or two when the sun gets too hot down there.

Can I make one suggestion? How about allowing a choice of colour coding based on the state of network connections (ala Process view) - say pastel shades which could be permanent (not go away after a few seconds) to enable one to monitor estblished or listening etc?

regards, Bernard

 

[torrentg]

From a command prompt:

netstat -abno

Wireshark is very good too. Process Hacker seems like a cool deal, although I never used it.