Home > Ask the Networking Experts > Enterprise security Questions & Answers > How do I find the application on my network that's dropping packets?
Ask The Networking Expert: Questions & Answers
EMAIL THIS

How do I find the application on my network that's dropping packets?

Michael Gregg EXPERT RESPONSE FROM: Michael Gregg

Pose a Question
Other Networking Categories
Meet all Networking Experts
Become an Expert for this site


Routing and switching news, advice and technical information
Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us    Add to Google


>
QUESTION POSED ON: 17 August 2009
Just had a fundamental doubt. In my network, the firewall is being sent packets to the SMTP port. I have blocked the port and am logging the dropped packets. I can see a certain PC which has been sending the packets. On network monitoring, we did not find the source port on the rogue PC. How do I find the application / service which is trying to send the packet to the firewall? Where should we run the packet filter tool?

>
When you capture these packets if you are using a tool such as Wireshark look at the look offset 0x23 and 0x24. This is the source port in a TCP header. In the middle frame of a packet capture it would look like this:

Middle frame of a packet capture
Click Image to enlarge screenshot.

In this example the source port is 2346. Source ports are typically chosen at random. If you have access to the system sending the traffic you can run a tool like fport or run netstat -an from the command line.


Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us    Add to Google



RELATED CONTENT
Network Security Monitoring and Analysis
Network penetration testing guide
Performing a penetration test
Penetration testing strategies
Penetration testing methodology and standards
Types of penetration tests
Network security forecast 2010: Startups cash out, uber-devices step up
Mobile computing security concerns lead to more IPS, SSL VPN spending
Application-specific network intrusion detection systems emerge
Anomaly-based intrusion protection configuration and installation
How can I calculate perimeter firewall throughput?

Network Management Software, Tools and Utilities
Improving network troubleshooting methodology, IP address management
Multivendor wireless network management software: APs under one roof
Looking at the new Magic Quadrant for wireless LAN infrastructure
Open source network monitoring: SLAs push network pros to new tools
Integrating wired and wireless network management
NetFlow traffic analysis tool solves network congestion woes for nonprofit
Using NAC endpoint fingerprinting to inventory dumb devices
Network management predictions for 2010: Automation, video, mobility
Unified wireless network still a work in progress for vendors
Out-of-band network management ensures data center network uptime

Enterprise security
How do I access Windows Server 2003 remotely if I've lost my admin password?
How does Active Directory for Cisco ACS work?
Does war driving enhance the security of wireless networks?
How can I access my secured wireless network without the security key?
How do I change my security setting to allow ActiveX?
What are two common devices that control outbound network access?
Can a network's IP address be stolen for the use of criminal activity?
How can I calculate perimeter firewall throughput?
Where can I find a wire driver that unblocks recognized passwords?
Is there a way to trace my stolen laptop computer?

RELATED GLOSSARY TERMS
Terms from Whatis.com − the technology online dictionary
deep packet inspection (DPI)  (SearchNetworking.com)
FCAPS  (SearchNetworking.com)
Nessus  (SearchNetworking.com)
netstat  (SearchNetworking.com)
port mirroring  (SearchNetworking.com)

RELATED RESOURCES
2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems
Search Bitpipe.com for the latest white papers and business webcasts
Whatis.com, the online computer dictionary



Search and Browse the Expert Answer Center
Search and browse more than 25,000 question and answer pairs from more than 250 TechTarget industry experts.
Browse our Expert Advice



Expert networking advice and tips for IT professionals
About Us  |  Contact Us  |  For Advertisers  |  For Business Partners  |  Site Index  |  RSS
SEARCH 
TechTarget provides technology professionals with the information they need to perform their jobs - from developing strategy, to making cost-effective purchase decisions and managing their organizations' technology projects - with its network of technology-specific websites, events and online magazines.

TechTarget Corporate Web Site  |  Media Kits  |  Site Map




All Rights Reserved, Copyright 2000 - 2010, TechTarget | Read our Privacy Policy
  TechTarget - The IT Media ROI Experts