http connection

[Al Smith]

ok, need some direction here, I have (108) stores that are connected through
a wan, that has a private address scheme. none of them are allowed to go out
to the internet. all connections go through checkpoint FW1. I have numerous
connections through the day trying to connect from each store pc (windows
2000 professional) to unknown.level3.net port 2920 and 2938.

Googling web, I found all kinds of items, that are way out there...

but what I need is for someone that has dealt with this, to tell me what it
is, and how to stop it. all attempts are dropped by firewall, but this
continually happens.

Thanks in advance

AL

 

[Danny Sanders]

to tell me what it

is, and how to stop it. all attempts are dropped by firewall, but this
continually happens.

You really can't stop them from knocking but you can stop them from getting
in, which is what happens when the firewall drops the connection.

Be more concerned with what is getting in.

hth
DDS

 

[Roger Abell [MVP]]

to tell me what it

You really can't stop them from knocking but you can stop them from
getting in, which is what happens when the firewall drops the connection.

Be more concerned with what is getting in.

But Danny, the post is about outbound activity.

 

[Danny Sanders]

My mistake,

I thought they were coming from the outside trying to get in.

If they are coming from the inside you need a to get a virus software
installed on the machines sending these packets. Adware/Spyware would not be
out of the question.


hth
DDS

 

[Al Smith]

we have anti-virus on ALL pc's. I wish these pc's were xp, versus 2000. as
with netstat on xp you can use -b and it will tell you what service is
running on http. does anyone know a way around this with win2000?

AL

 

[Danny Sanders]

See:
http://www.microsoft.com/technet/sysinternals/utilities/TcpView.mspx


hth
DDS

 

[Al Smith]

excellent thanks...

See:
http://www.microsoft.com/technet/sysinternals/utilities/TcpView.mspx


hth
DDS

 

[Al Smith]

ran program, all it says is SYSTEM 8, which also runs outlook and dns...
thanks anyway...

AL

 

[Roger Abell [MVP]]

Hmmm

For a second I thought PortReporter might help, but not having
used it on W2k I reviewed the info
http://support.microsoft.com/kb/837243
and it appears it will not provide the needed info on specific
modules within the PID either.

It is pretty surprising how much exists about unknown.level3.net
on the net without there actually being any info about it.
DNS shows it is just an alias for www.level3.com but it surely
behaves differently when the hostheader is not www.level3.net

 

[Al Smith]

thanks... yup not much is known about what service is running it, just that
they exist???

AL