Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a Windows Server 2003 machine that I'm trying to decommission but my SQL Server team are telling me that there are still calls coming from this machine to the SQL Server machine. I have shut down everything (that I can think of) but apparently I still have something calling out.

How can I trace/find the service/application that's calling out to the SQL Server machine?

share|improve this question
I don't know what the definitive answer will turn out to be other than "Check everywhere" , but it sure seems a lot easier for the SQL Team to give you all the information they have instead of "...something is still calling out from your server". – dimitri.p Aug 21 '09 at 22:44

Here's a couple of ideas:

If the program has a persistent connection open you'll see the process ID (right column) in:

netstat -a -n -o | find "TCP" | find "1433"

(That assumes it's connecting to the default instance, TCP port 1433, on the destination server.) You could also put the destination server's IP in there in place of the 1433, too.

If it's intermittent you'll have a harder time catching it with netstat. The TCP/IP monitoring functionality of Process Monitor could give you a long-running trace that might show you something.

Your SQL Server admins could run an SQL trace on their end and see what application proports to be connecting, but that won't necessarily be accurate.

share|improve this answer

Apart from the good answers already, set up a trace in Profiler and see what the sql statements are that are being run. That should give you a good clue what is trying to access your DB.

If you have no sql being run, then it doesn't really matter if something else is trying to access the server - you can still shutdown the SQL server.

If you need to know what other networking calls are being made to it, install wireshark and watch them as they happen.

share|improve this answer
It is not his DB – dimitri.p Aug 21 '09 at 23:22
If he has no access to a shell then wireshark, and netstat are both out the running. However, he will still be able to run Profiler if he can run Management Studio. – gbjbaanb Aug 22 '09 at 13:35

Have the SQL Server team check using a query similar to the following. This should give you more information as to what process is doing it:

SELECT conn.connect_time, conn.client_net_address,
  sess.login_time, sess.HOST_NAME, sess.program_name, sess.login_name
FROM sys.dm_exec_connections conn
  INNER JOIN sys.dm_exec_sessions sess
    ON conn.session_id = sess.session_id;
share|improve this answer
I'm assuming SQL Server 2005/8. If you're on 2000, there are other queries which can be used. – K. Brian Kelley Aug 22 '09 at 0:37

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.