Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Last night I loaded up Fiddler2 to do a little debugging and I saw three connections to domains like

hghefhhig

How can I go about isolating the application responsible?

I was thinking possibly logging all outbound connections to domains that do not contain a "."

Any ideas are greatly appreciated =]

PS: The domains did not resolve, if they had, I would be freaking out.

Jeff

share|improve this question

1 Answer 1

up vote 2 down vote accepted

enter image description here

Fiddler does show which process the connections originate from.

share|improve this answer
    
I cant believe I didnt catch that before =] Thank you! Is there anyway to pull a stack trace from the offending application? –  jroberts Nov 30 '12 at 17:27
    
@jroberts Do you mean from fiddler directly? I'm not sure if that is possible. You can always hook a debugger to the process to view the stack trace though. –  Terry Chia Nov 30 '12 at 17:30
    
I was hoping for something a little more passive, but that is a good call, thing is, I was in fiddler all night, and I only saw the connections once, so catching them as they happen is like a needle in a haystack –  jroberts Nov 30 '12 at 17:32
    
For the record, since it is Chrome, it is probably legitimate behavior for detection of upstream DNS NXDOMAIN tampering. See: serverfault.com/questions/235307/… –  hwilbanks Nov 30 '12 at 23:09
    
@hwilbanks The Chrome screenshot is just an example from my on system. The asker didn't mention where the traffic originated from. –  Terry Chia Dec 1 '12 at 2:19

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.