2

I'm trying to record data of all the processes that establish connections from my PC for security issues, I tried to do netstat -bn 1 > stats.txt, also tried to make a log file with CurrPorts, TCPView from what I've seen doesn't even have an option to log changes,

but what's wierder is that they all occasionaly show processes as "unknown", CurrPorts seems to be the best so far but also lists some unknown processes.

1.How is it possible that processes have unknown paths? doesn't the system know the path of any process that establishes a connection?

2.Is there another tool I haven't used or some other way to log the processes that establish connections in a clear way and with the paths of all the processes?

1
  • I had the same issue using CurrPorts, except I had maybe 20 of them. I noticed the IP addresses and names of some: Comodo and Google, for starters. My guess then was that it was my DNS settings. So I changed them and ALL of those entries disappeared. I'm unable to directly answer your question. But if it helps you to at least be able to possibly identify and rid yourself of those entries, perhaps my experience will help you.
    – user518345
    Nov 5, 2015 at 17:30

2 Answers 2

1

1.How is it possible that processes have unknown paths?

The system knows the Process IDs. (Specifically, the networking stack must know this.) The process IDs are just unknown to netstat.

doesn't the system know the path of any process that establishes a connection?

Yes. When the TCP/IP stack (responsible for common protocols, including TCP and UDP and perhaps ICMP) receives information, it sends that information to programs. This ability permits your computer to have multiple conversations, with different pieces of software running on the system, and send incoming data to the correct conversation. TCP's design requires incoming data to be processed as part of the initializing handshake. UDP also supports this somewhat, which is why you can simultaneously make multiple DNS requests and the computer will know which response is meant to match with each request.

2.Is there another tool I haven't used or some other way to log the processes that establish connections in a clear way and with the paths of all the processes?

netstat -b should be able to do that just fine. (This syntax is for modern versions of Microsoft Windows. Other netstat implementations may use different parameters.) The -n parameter just eliminates Reverse DNS details, which people commonly eliminate (usually because it can slow things down).

The problem is likely an issue with permissions, which I would hope would also affect any other tools. (Otherwise, the expected security benefits may not be working as one would hope.)

Best bet: Make sure you're an Administrator. If you're using Windows Vista or newer, make sure that if UAC is enabled, then you're using an elevated command prompt.

netstat -nb ought to show you PID numbers. Converting that to paths is done separately, e.g. with TASKLIST or:
WMIC PROCESS GET Caption,CommandLine,Description,ExecutablePath,Name,ParentProcessId,ProcessId /FORMAT:VALUE

0

Short lived processes or processes exiting during the sampling might be missed by your commands.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .