1

I have 2 Windows Server 2003 boxes that sit idle, for the most part, on weekends. Yet when I look at my router's DNS logs, both machine's are making many requests for www.yahoo.com when there's nobody using the machine.

None of the programs that run in perpetuity make any requests to Yahoo that I know of. The requests happen at a rate of slightly more than 1/minute.

Is there a way that I can find out which program or service running is making these requests?

0

3 Answers 3

5

Install Microsoft Network Monitor. Start a Capture. Filter the Capture for DNS, HTTP and HTTPS. Look at the captured results. NetMon will list each process responsible for it's corresponding network traffic, which should allow you to track it down. Granted that the DNS client process is going to be responsible for any DNS related traffic relevant to Yahoo, which isn't going to tell you the "why" of it, but filtering for HTTP and HTTPS should allow you to see what other processes may be trying to connect to Yahoo.

3
2

You'll need to enable certain debugging in the Windows DNS server in order to gather who is making the request:

enter image description here

Pick things like Details as well.

You might also need to use Wireshark or Netmon to capture the packets in order to fully understand what is happening.

0

Install netstat for windows. This program shows you active TCP connections and their associated process ids (pid). Associate the pid with the program name in the Task Manager to determine which program is making the connections.

For example:

c:\>netstat -anb 
TCP    0.0.0.0:8081           0.0.0.0:0              LISTENING       2044
[FrameworkService.exe]

(note others are correct, netstat is a built in windows command, no need to install anything)

2
  • 6
    ? Netstat doesn't need to be installed. Netstat is a built-in tool.
    – joeqwerty
    Sep 19, 2013 at 16:38
  • @joeqwerty well, "activated" or whatever. sometimes these things need to be activated in windows before you can use them. telnet, for one, always bites me Sep 20, 2013 at 0:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .