Hi Guy,
I'm getting closer. In using tshark to record all the SMTP traffic I
was able to grep 'helo' and 'ehlo'. I got a hit on 'helo' where my
server was saying it was a well known ISP. It is not. I then was able
to cross reference the destination IP with the netstat log that showed
that is was in fact php script. Now to find out which one. I have the
PID but of course the script is not currently running.
Ant thoughts on how to track down the script?
Sincerely,
Mike
--
Mike Brandonisio * Web Hosting / Development
Tech One Illustration * Internet Marketing
tel (630) 759-9283 x1001 * e-Commerce
mbrando@xxxxxxxxxxxxxx * www.jikometrix.net
JIKOmetrix - Reliable web hosting
Guy Harris wrote:
On Oct 12, 2009, at 6:33 AM, Mike Brandonisio wrote:
Is it possible to include netstat as part of the trace with tshark?
TShark doesn't include any code to fetch any "what process has a
socket bound to or connected to a given endpoint" information, so, no,
netstat information isn't part of a Wireshark/TShark trace (not that
there's any provision in pcap file format to store that anyway,
although pcap-NG could do that).
___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe
|
begin:vcard
fn:Mike Brandonisio
n:Brandonisio;Mike
org:Tech One Illustration
adr:;;231 S. Cranberry St.;Bolingbrok;Illinois;60490;US
email;internet:mbrando@xxxxxxxxxxxxxx
title:Principal
tel;work:630-759-9283 x1001
tel;fax:630-214-9877
x-mozilla-html:FALSE
url:http://www.jikometrix.net
version:2.1
end:vcard
