Find process making outbound connections
Posted on 2014-03-09
I have a system which is repeatedly trying to make an outbound connection on port 4343. Judging from the pcap I took from the perimeter firewall, the connection is never fully established. It attempts the same public IP for each connection attempt.
I have since made sure this port outbound is not allowed.
Anyhow, I see the system still attempts connections as it is filling up my Deny logs. What is the best way to find out what process on this system is attempting this connection? I have tried TCPView and Currports but neither show this activity. I am not sure if those only show it once the connection is established or not. I also do not see anything from netstat -ano.