Strange UDP behavior

[North323]

so i logged onto one of my domain controllers and did netstat -a and got this weird udp jazz going on

UDP some_server:49433 *:*
UDP some_server:49440 *:*
UDP some_server:49457 *:*
UDP some_server:49467 *:*
UDP some_server:49472 *:*
UDP some_server:49475 *:*
UDP some_server:49489 *:*
UDP some_server:49492 *:*
UDP some_server:49494 *:*
UDP some_server:49499 *:*
UDP some_server:49505 *:*
UDP some_server:49518 *:*
UDP some_server:49531 *:*
UDP some_server:49534 *:*
UDP some_server:49549 *:*
UDP some_server:49553 *:*
UDP some_server:49555 *:*
UDP some_server:49556 *:*
UDP some_server:49560 *:*
UDP some_server:49561 *:*
UDP some_server:49565 *:*
UDP some_server:49570 *:*
UDP some_server:49571 *:*
UDP some_server:49573 *:*
UDP some_server:49574 *:*
UDP some_server:49575 *:*
UDP some_server:49576 *:*
UDP some_server:49577 *:*
UDP some_server:49579 *:*
UDP some_server:49583 *:*
UDP some_server:49597 *:*
UDP some_server:49605 *:*
UDP some_server:49608 *:*
UDP some_server:49609 *:*
UDP some_server:49626 *:*
UDP some_server:49635 *:*
UDP some_server:49641 *:*
UDP some_server:49643 *:*
UDP some_server:49647 *:*
UDP some_server:49649 *:*
UDP some_server:49672 *:*
UDP some_server:49677 *:*
UDP some_server:49683 *:*
UDP some_server:49685 *:*
UDP some_server:49693 *:*
UDP some_server:49701 *:*
UDP some_server:49708 *:*
UDP some_server:49711 *:*
UDP some_server:49712 *:*
UDP some_server:49714 *:*
UDP some_server:49715 *:*
UDP some_server:49725 *:*
UDP some_server:49726 *:*
UDP some_server:49727 *:*
UDP some_server:49744 *:*
UDP some_server:49752 *:*
UDP some_server:49760 *:*
UDP some_server:49786 *:*
UDP some_server:49787 *:*
UDP some_server:49788 *:*
UDP some_server:49797 *:*
UDP some_server:49798 *:*
UDP some_server:49803 *:*
UDP some_server:49804 *:*
UDP some_server:49808 *:*
UDP some_server:49810 *:*
UDP some_server:49814 *:*
UDP some_server:49820 *:*
UDP some_server:49827 *:*
UDP some_server:49830 *:*
UDP some_server:49846 *:*
UDP some_server:49848 *:*
UDP some_server:49851 *:*
UDP some_server:49855 *:*
UDP some_server:49861 *:*
UDP some_server:49864 *:*
UDP some_server:49865 *:*
UDP some_server:49869 *:*
UDP some_server:49874 *:*
UDP some_server:49884 *:*
UDP some_server:49900 *:*
UDP some_server:49905 *:*
UDP some_server:49909 *:*
UDP some_server:49910 *:*
UDP some_server:49942 *:*
UDP some_server:49951 *:*
UDP some_server:49955 *:*
UDP some_server:49972 *:*
UDP some_server:49984 *:*
UDP some_server:49988 *:*
UDP some_server:49992 *:*
UDP some_server:49994 *:*
UDP some_server:50001 *:*
UDP some_server:50004 *:*
UDP some_server:50009 *:*
UDP some_server:50028 *:*
UDP some_server:50030 *:*
UDP some_server:50035 *:*
UDP some_server:50037 *:*
UDP some_server:50043 *:*
UDP some_server:50058 *:*
UDP some_server:50063 *:*
UDP some_server:50067 *:*
UDP some_server:50072 *:*
UDP some_server:50080 *:*


Whats the deal here? Im not a microsoft guy...im a cisco guy

 

[Grenage]

What does netstat -b reveal?

"We can categorically state that we have not released man-eating badgers into the area" - Major Mike Shearer

 

[North323]

is netstat -b a valid command?

 

[Grenage]

Should show you which processes are using which ports, etc.

"We can categorically state that we have not released man-eating badgers into the area" - Major Mike Shearer

 

[itsp1965]

Perform a netstat -ao which will list the associated process ids (PID col) that are using these ports. Go to task manager and check the process against the PID number (if you don't see the PID column go to View add columns and add the PID column)

 

[North323]

I dont see netstat -ao as an option either:

C:\Documents and Settings\admin>netstat ?

Displays protocol statistics and current TCP/IP network connections.

NETSTAT [-a] [-e] [-n] [-s] [-p proto] [-r] [interval]

-a Displays all connections and listening ports.
-e Displays Ethernet statistics. This may be combined with the -s
option.
-n Displays addresses and port numbers in numerical form.
-p proto Shows connections for the protocol specified by proto; proto
may be TCP or UDP. If used with the -s option to display
per-protocol statistics, proto may be TCP, UDP, or IP.
-r Displays the routing table.
-s Displays per-protocol statistics. By default, statistics are
shown for TCP, UDP and IP; the -p option may be used to specify
a subset of the default.
interval Redisplays selected statistics, pausing interval seconds
between each display. Press CTRL+C to stop redisplaying
statistics. If omitted, netstat will print the current
configuration information once.

this is widows 2000

 

[Grenage]

This is available with a windows 2000 update:

http://support.microsoft.com/kb/907980

"We can categorically state that we have not released man-eating badgers into the area" - Major Mike Shearer