I'm redoing my firewall configuration with more restrictive policies and I would like to determine the provenance (and/or destination) of some outgoing connections.
I have an issue because they come from svchost.exe and go to web content/application delivery providers - or similar:
5 IP in range: 126.96.36.199 - 188.8.131.52 --> Akamai Technologies akamaitechnologies.com 3 IP in range: 184.108.40.206 - 220.127.116.11 --> Akamai Technologies akamaitechnologies.com 2 IP in range: 18.104.22.168 - 22.214.171.124 --> LLNW Europe 2 llnw.net 126.96.36.199 --> CacheNetworks, Inc. cachefly.net 188.8.131.52 --> Go Daddy Netherlands B.V. secureserver.net
So is it possible to know which service does a particular connection? Or what's your recommendation about the rules applied to these ones?
(Comodo Firewall & Windows 7)
netstat -ano &
tasklist /svc help me a little but they are many services in one svchost.exe so it's still an issue. moreover the service names returned by "tasklist /svc" are not easy readable.
(All the connections are HTTP (port 80) but I don't think it's relevant)