Microsoft Windows XP Home Edition - Zenk - Security - Repository

Microsoft Windows XP Home Edition
Security Implementation
Version 1.4b Option 1
You need to periodically check your active ports. You can use multiple tools to
investigate ports. First tool you want to use is the Task Manger. You can open
this tool by pressing CTRL+SHIFT+ESC. You should click on the Processes
Tab. You want to make sure that the Show Processes from all users box is
selected. You have the option to sort this window by any column that you wish.
You need to click on the column header of the column that you want to sort by.
In XP you need to add the PID column. The PID is the Process ID of the process
that is running. From the View option in the Menu Bar use the Select Columns
option. This will open another window that you can select which columns you
want to add. Select PID and click OK. If you find a process that you don’t
recognize you can run the Tasklist command at the command line. Once you are
Key
at a
fingerprint
command
=
prompt
AF19 FA27
type
2F94
tasklist
998D
/svc.
FDB5
This
DE3D
will
F8B5
list the
06E4
names
A169
of
4E46
all the
windows services that are running along with the PID and image listing of the
service. Another command that you can use to help investigate is the netstat
command. From the command line, type netstat -an. This will list display the
current protocol statistics and current connections. There are five columns in this
output. The first column is the Protocol (TCP or UDP), then Local Address,
Foreign Address, State, and PID. Your computer has three different local
addresses (0.0.0.0, 127.0.0.1, and 10.0.0.3). After each IP address is the port
number that the address is connected to or listening on. A Local Address output
sample is 0.0.0.0:135. The IP address is 0.0.0.0 and the Port number is 135.
Below is a sample line from the netstat command.
TCP 0.0.0.0:135 0.0.0.0:0 LISTENING 944
TCP is the protocol for this output. The Local Address is 0.0.0.0 (your IP) and
the port number is 135. The Foreign Address is 0.0.0.0 (your IP) and the port
number is 0. This service is currently in a LISTENING state. This means that
the port is open and waiting for another computer to connect to it. Another state
that a port can be in is ESTABLISHED, meaning that the port is currently talking
to another computer. The PID of this service is 944.
Now that we have most of the information necessary to investigate the service,
we need to check with the IANA port list to see what service or application uses
port number 135. Next you want to check the Task Manager to see what service
has the PID of 944. If the service is listed as svchost.exe you can use the
tasklist command next to get a name of the service. You now can determine
whether you should leave this port open or close it.
© SANS Institute 2003, Author retains full rights
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46
Page 44 of 53
© SANS Institute 2003, As part of the Information Security Reading Room. Author retains full rights.