up vote 0 down vote favorite
share [g+] share [fb]

I have following question: on my firewall i can see connections from my win 2003 server:

 Feb  8 15:18:53 gw kernel: [5197300.553485]  **LEGACY** IN=tun6 OUT=vlan1    SRC=192.168.70.195 DST=192.168.8.179 LEN=106 TOS=0x00 PREC=0x00 TTL=126 ID=11183 PROTO=UDP  SPT=3611 DPT=161 LEN=86

But i can't see this traffic from win 2003 (192.168.70.1) with netstat or with TCPView What else can be done to find source application for this traffic?

link|improve this question
feedback

1 Answer

up vote 0 down vote

Install Microsoft Network Monitor on the server in question, start a capture, and look for the process responsible for the traffic.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.