Home > Ask the Networking Experts > Enterprise security Questions & Answers > How do I find the application on my network that's dropping packets?
Ask The Networking Expert: Questions & Answers
EMAIL THIS

How do I find the application on my network that's dropping packets?

Michael Gregg EXPERT RESPONSE FROM: Michael Gregg

Pose a Question
Other Networking Categories
Meet all Networking Experts
Become an Expert for this site


Routing and switching news, advice and technical information
Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us    Add to Google


>
QUESTION POSED ON: 17 August 2009
Just had a fundamental doubt. In my network, the firewall is being sent packets to the SMTP port. I have blocked the port and am logging the dropped packets. I can see a certain PC which has been sending the packets. On network monitoring, we did not find the source port on the rogue PC. How do I find the application / service which is trying to send the packet to the firewall? Where should we run the packet filter tool?


Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us    Add to Google



RELATED CONTENT
Network Security Monitoring and Analysis
Application-specific network intrusion detection systems emerge
Anomaly-based intrusion protection configuration and installation
How can I calculate perimeter firewall throughput?
Integrating NAC with network security tools
Where can I find a sample security audit report? How can I run my own?
The firewall remains the network traffic cop, but its role is changing
Troubleshooting VLANs: How to monitor 802.1q tagged traffic
Poor data-loss prevention practices almost cost Intel a billion
How can I block my competitor's IP address range from my website?
Hospital gains network visibility by convincing vendors to collaborate

Network Management Software, Tools and Utilities
Out-of-band network management ensures data center network uptime
Web gateway helps Texas manufacturer develop network user management
Network automation lags general IT process automation for now
How can I calculate perimeter firewall throughput?
Where can I find a wire driver that unblocks recognized passwords?
What network loss testing tools/methods calculate dropped packets from a PC?
Network user management
Green enterprise: Three networking investments that make a difference
Dynamic policy ensures faster, safer network for school district
Storage area networks change management primer

Enterprise security
How can I calculate perimeter firewall throughput?
Where can I find a wire driver that unblocks recognized passwords?
Is there a way to trace my stolen laptop computer?
Is WPA2 secure enough for a commercial business wireless network?
Should organizations separate technical from administrative security?
What network equipment is needed to secure a small business LAN?
How to lock wireless routers
Are you on a domain name system (DNS) blacklist database?
Where can I find a sample security audit report? How can I run my own?
Why are TCP/IP networks considered unsecured?

RELATED GLOSSARY TERMS
Terms from Whatis.com − the technology online dictionary
deep packet inspection (DPI)  (SearchNetworking.com)
FCAPS  (SearchNetworking.com)
Nessus  (SearchNetworking.com)
netstat  (SearchNetworking.com)
port mirroring  (SearchNetworking.com)

RELATED RESOURCES
2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems
Search Bitpipe.com for the latest white papers and business webcasts
Whatis.com, the online computer dictionary


When you capture these packets if you are using a tool such as Wireshark look at the look offset 0x23 and 0x24. This is the source port in a TCP header. In the middle frame of a packet capture it would look like this:

Middle frame of a packet capture
Click Image to enlarge screenshot.

In this example the source port is 2346. Source ports are typically chosen at random. If you have access to the system sending the traffic you can run a tool like fport or run netstat -an from the command line.




Search and Browse the Expert Answer Center
Search and browse more than 25,000 question and answer pairs from more than 250 TechTarget industry experts.
Browse our Expert Advice



Expert networking advice and tips for IT professionals
About Us  |  Contact Us  |  For Advertisers  |  For Business Partners  |  Site Index  |  RSS
SEARCH 
TechTarget provides technology professionals with the information they need to perform their jobs - from developing strategy, to making cost-effective purchase decisions and managing their organizations' technology projects - with its network of technology-specific websites, events and online magazines.

TechTarget Corporate Web Site  |  Media Kits  |  Site Map




All Rights Reserved, Copyright 2000 - 2009, TechTarget | Read our Privacy Policy
  TechTarget - The IT Media ROI Experts