如何调试来自我们自己的应用程序的虚假 TCP 请求？
我们有一个 .NET 应用程序，它在某个服务器上不断发出各种 TCP 请求，这些请求被我们的防火墙阻止。
应用程序没有理由尝试访问互联网，它只需要与我们的数据库服务器通信。
它似乎正在尝试联系deploy.akamaitechnologies.com 上的某个地址，该地址显然为不同的人/公司托管了大量不同的文件。
如何调试该请求来自代码的哪一部分？ TCPView 指示请求直接来自我们的 .exe。
该代码使用 nHibernate 库，我的第一个猜测是库试图自动更新自身，但大概请求不会直接从我们的 .exe 发出？
我们的 .exe 是否会感染该特定服务器上的病毒？我们的防病毒软件是最新的，扫描 .exe 没有发现任何信息。
编辑：好的，我终于在服务器上安装了 Wireshark，但不知道如何处理输出。我注意到的几件事是，它会向 RIPE 网络协调中心拥有的 IP 地址发送一条“名称查询 nbstat”，并且还会从“src port caicci”再次向 RIPE 网络协调中心拥有的 IP 地址上的 http 端口发送一条消息。 RIPE 网络协调中心。很难跟踪所有相关请求，因为我事先不知道它将使用哪些 IP 地址（每次都不同），并且如果我让它捕获超过一个时间，Wireshark 似乎会由于数据量而崩溃。分钟左右。显然你不能按进程过滤？
We have a .NET application which, on a certain server, keeps making various TCP requests which are being blocked by our firewall.
The application has no reason to try to access the Internet, it only needs to communicate with our database server.
It seems to be trying to contact a certain address at deploy.akamaitechnologies.com, which apparently hosts a vast number of different files for various people/companies.
How can I debug which part of our code this request is coming from? TCPView indicates the request is coming directly from our .exe.
The code uses nHibernate libraries, my first guess was that a library was trying to update itself automatically but then presumably the request wouldn't be issuing direct from our .exe?
Could our .exe be infected with a virus on that particular server? Our anti-virus is up-to-date and scanning the .exe reveals nothing.
EDIT: OK I've finally got Wireshark on the server, not sure what to do with the output though. A couple of things I've noticed is that it sends a "name query nbstat" to an IP address owned by RIPE Network Coordination Centre, and also a message from "src port caicci" to the http port again on an IP address owned by RIPE Network Coordination Centre. It's hard to track all of the relevant requests because I don't know in advance which IP addresses it will use (it's different every time), and Wireshark seems to crash due to the volume of data if I leave it capturing for more than a minute or so. Apparently you can't filter by process?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
您确定正在运行的名为
YourApp.exe的 exe 实际上是您认为的那个吗？您可以对受信任的 exe 进行 md5sum 并与服务器上的进行比较吗？假设您没有在服务器上安装 Visual Studio（或者无法远程调试），那么您可以获取进程的转储并在您自己的计算机上进行分析。它是.NET4进程吗？
Are you sure the exe that is running called
YourApp.exeis actually the one you think it is? Can you do an md5sum of a trusted exe and compare with one on the server?Assuming you dont have Visual Studio installed on the server (or can't remote debug) then you can get a dump of the process and analyze on your own machine. Is it a .NET4 process?