Workstation Chatterboxes...

[CharlieIT]

I have a firewall that sits between all of my clients and the Internet. I have the firewall blocking everything from the WAN to the LAN except for things I know about (e.g. mail, etc.). I used to have the firewall configured to allow anything from the LAN to the WAN. However, the other day I made a change so that the firewall blocks everything from the LAN to the WAN except for things I know about.

My firewall log now shows that three of my client's workstations on my network are trying to connect to a WAN address on TCP port 4367. Of course, the firewall is blocking this from happening, but I'm trying to figure out what is initiating this traffic.

I went to the workstations themselves and didn't see any programs installed out of the ordinary. I ran a full virus scan on these PC's with the latest definitions and it turned up nothing. I also checked the PC's for Spyware and Adware, and although those programs cleaned some stuff up, the PC's are still trying to connect to the WAN on TCP port 4367.

Does anyone know how I can track down what is causing this traffic?

Thank You!

 

[Serbtastic]

If you are using Windows XP, use the command netstat -ano to find the pid trying to connect to that port, otherwise you can use Systernals tcpview utility (

http://www.sysinternals.com/ntw2k/source/tcpview.shtml)

to find it.