Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a NT4 server that in the last two weeks started to generate too many weird DNS queries to the DNS server is set to use. I have got warnings from the IPS system that it has blocked the responses from the DNS server back to the NT4 server.

The queries it generate doesn't relate to any computer in the network, it is like 120624100088.xxxxxxx.net where xxx is the internal network, the numbers are just random at each query.

I have done some research on how to get the PID that is generating the queries, and i found that only Process Monitor could give me that information, but since it is NT4 system Process Monitor doesn't work on it.

It is a production server and i am just can't stop services as i want.

I would like to get your advice on how can i get the PID that is generating these queries?

Thanks.

share|improve this question
add comment

1 Answer

netstat command (command-line) can give you the PID's of the processes too. You may have to run it a number of times as it makes a snapshot of the state of the network connections. That snapshot may just miss the ones you are actually interested it.

You may have to fiddle with the options to the command. Definitely use -n because that greatly speeds up the processing. (You are looking for DNS so you can just filter out any output not refering to port 53 and the ip-address of the DNS server.)
If the process turns out to be svchost.exe then you will have to use Process Monitor or a similar utility (I believe ProcesExplorer from SysInternals still works in NT4, you may have to find an old version of it) to determine which processes are using svchost as intermediary.

Just one question though.... NT4 ?... connected to the Internet ?.... Somebody should be shot for that.

share|improve this answer
    
NT4 not connected. Somebody could give me the syntax for netstat? –  Hanan N. Oct 21 '12 at 10:18
    
The precursors of Process Monitor were FileMon and RegMon. Process Explorer is something entirely different. And AFAIR the netstat command on Windows didn't support showing the PID before Windows XP. TCPView may be able to provide that information, though. –  Ansgar Wiechers Oct 21 '12 at 11:04
    
I found the CurrPorts program from NirSoft, it seems to have more information than TCPView, since to me TCPView couldn't help much. –  Hanan N. Oct 21 '12 at 11:21
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.