Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm working on setting up a hardened application server with the Windows Firewall enabled.

OS is 2008 R2. We're using the Advanced firewall settings and have IPSec and Kerberos authentication if it matters. One of my other hosts (192.168.100.21) needs to reach my server (192.168.100.29) in order for my application to work properly. If I allow all inbound traffic from that IP it functions flawlessly. That unfortunately doesn't meet my regulatory requirements.

The auditing events show that the connection attempt is being made to svchost, however it isn't succeeding. How can I determine which service(s) are attempting to be accessed?

I've used the debugging auditing shown below to determine the svchost behavior.

auditpol /set /subcategory:"Filtering Platform Packet Drop" /success:enable /failure:enable
auditpol /set /subcategory:"Filtering Platform Connection" /success:enable /failure:enable
auditpol /set /subcategory:"IPsec Driver" /success:enable /failure:enable
auditpol /set /subcategory:"IPsec Main Mode" /success:enable /failure:enable
auditpol /set /subcategory:"IPsec Quick Mode" /success:enable /failure:enable
auditpol /set /subcategory:"IPsec Extended Mode" /success:enable /failure:enable
share|improve this question

1 Answer 1

up vote 1 down vote accepted

As you know SVCHOST is just an umbrella service for underlying services, most of which manifest themselves as DLLs, as opposed to EXEs. If it were me, I'd use three Microsoft SysInternals tools and TASKLIST:

  • ProcessMonitor : This will let you actually see the TCP/UDP requests, and more specifically, which port(s) are being used
  • TCPView : This lets you see TCP/UDP connections come and go (kind of like a live NETSTAT)
  • ProcessExplorer : This will let you see dig around and see exactly which SVCHOST instance is being referenced

So, once you've seen the TCP/UDP activity, and you know which SVCHOST is being referenced, and you know which ports, you can use TASKLIST to see which services are being hosted by that SVCHOST (tasklist /svc /fi "imagename eq svchost.exe"), and then, using the port number, deduce exactly which service it is.

That would be my approach anyway. Good luck.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.