0

While testing our software, a large corporate customer was able to detect the third-party licensing software using port 137.

Up until this point we have only been aware of the license software using port 443.

I have looked into this with netstat, Get-NetTCPConnection, and TCPView but I can only find process activity on port 443.

When I asked the licensing company about this they acknowledged they use 137 to get the UUID for certain license types.

I am inexperienced with networking and hope that you can tell me how to see this behavior for myself.

Improve this question
7
  • 1. The customer has said they saw this behavior and the licensing company said that it's true. Why do you need to see it for yourself? 2. What does the customer want you to do about it?
    – joeqwerty
    May 4, 2022 at 2:55
  • 1. I want to see it because I was not aware it was being used. Don't want to be blindsided by our software doing things we don't expect again. 2. The customer will not allow this port to be used.
    – NinjaLlama
    May 4, 2022 at 3:01
  • Port 137 is netbios-ns (netbios name service) and although both TCP and UDP are reserved Windows only uses UDP, so you will never see a 'connection' using this port (UDP doesn't have connections). netstat -nao or tcpview with 'show unconnected endpoints' on (and preferably 'resolve addresses' off) should show it; they do on my system (W10 home). However, use of this service goes through pseudo-process 4 (System) so I don't think you'll see what program(s) are using it.
    – dave_thompson_085
    May 5, 2022 at 2:52
  • You need to be more specific on what you mean by the software "using a port". It can be interpreted either as "accepting connections on the port", or "making connections to that port on some other service", or both. Depending on which meaning you are referring to, you need different tools, and you may miss the second case altogether because the use may depend on specific conditions.
    – Tilman Schmidt
    May 5, 2022 at 22:36
  • @TilmanSchmidt It is sending packets through port 137. I was able to see it using SmartSniff while stepping through the software execution.
    – NinjaLlama
    May 7, 2022 at 19:03

3 Answers 3

Reset to default
0

Nirsoft.net has a tool for this called Smart Sniff. You should have NPCap or WinPcap installed to use it. SmartSniff records each connection your computer makes, and displays one line per connection. In the Remote port column, you should at some point, see a connection to some host on port 137, and which process initiated that connection. There are filtering options as well as other configuration options which may reveal what you are looking for.

By default, it does not capture process information, so you'll need to configure it:

  • After NPCap is installed, launch SmartSniff.
  • Hit F6 to halt active captures
  • Open Options menu:
    • Select 'Capture options' at bottom
    • If necessary, change to 'WinPcap Packet Capture Driver' and close menu
  • Open Options menu:
    • Select 'Retrieve process information while capturing packets' and click OK.
  • Hit F5 to start capturing again. SmartSniff looks like this:

.

Improve this answer
2
  • 1
    Thanks for the detailed response. I have followed this and see the same port 443 usage that I saw before, and expected. I have no idea where they are finding this port 137 usage.
    – NinjaLlama
    May 6, 2022 at 1:34
  • 1
    After lengthy diagnosing I was able to use this tool to find that my netbios-ns traffic occurs after a pdf has finished loading in a WebBrowser control. Now to just figure out why this is happening and if I can stop it.
    – NinjaLlama
    May 7, 2022 at 15:53
0

U can use the Ressource Monitor. It will show every TCP connection and which program is listening on which port.

Alternative would be to use netstat in command prompt.

Improve this answer
2
  • Ok, I will try Resource Monitor to detect this behavior. I have already tried netstat and was unable to see any port 137 usage from this software.
    – NinjaLlama
    May 4, 2022 at 11:57
  • I have started resource monitor and ran the application. I still only see port 443 on this as well as netstat again.
    – NinjaLlama
    May 5, 2022 at 0:15
0

Try this tool crowdinspect

This app is a Host-Based Process Inspection tool for maleware analysis purposes Screenshot, it has live\History process network activity monitoring, hope it helps :).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .