I ran a vulnerability scan against a server and it is pulling back a lot of Adobe vulnerabilities. I ran a Wireshark capture on the scan but I can't seem to write up a Wireshark filter on the packets. Does anyone know how to look for the versions of Adobe in Wireshark? (or any tool that will remotely pull the versions would be helpful).
**edited. I did say Apache in my first question. I found the Apache article and had that stuck in my head when I wrote it. I need ADOBE versions.
It's EVERYWHERE... like a virus.
Adobe uses Apple's Bonjour service also known as mDNSResponder.exe to communicate with the mother ship. More about Bonjour here. Adobe transfers things like licensing, usage, and error data. They also run a service called armsvc.exe which is the Adobe Acrobat Update Service that also calls home to check for updates periodically. Adobe has a video about how to remove mDNSReponsder on their TV site.
If you're running a Creative Suite on your server (not likely, but not unheard of) you'll also get traffic from different plug-ins in various apps that connect to web services, also anything that uses the Creative Cloud will also likely transfer data and try to authenticate a license, as well as all web programs like Dreamweaver, Muse, and Flash obviously.
If this is a Windows box, you can use sysinternals process explorer to check for different running apps and the company name of the owner of the process. If it's a Mac server then you can open activity monitor to see what's running, in addition to top via command line.
example.com/?AAAAAAAAAAA...with 4000+ 'A's) to force a HTTP 414. Almost always leaks the version through such error responses.