Member Avatar for The Dude

Very interesting thread where a users claims that he discovered DoD trying to connect to his vista pc.

http://www.whitedust.net/news/3984/United_States_Government_Online_Watchdogs?_Part_of_the_war_on_terror?

Anyone running Vista here should check thier net connections!

  • 3 Contributors
  • 3 Replies
  • 111 Views
  • 3 Months Discussion Span
  • Latest Post Latest Post by TonyB

Dani AI

Generated

A few quick points tied to the posts above (, and ): an observed remote IP that looks like it belongs to the DoD is not proof of a targeted government intrusion. Many ordinary causes (P2P, background Internet scans, third‑party monitoring services and misattributed addresses) can produce the same symptom. The safest course is a methodical check rather than jumping to conclusions.

Steps to identify the connection and the owning process:

netstat -ano | findstr ESTABLISHED

Note the remote IP and the PID shown. Then map the PID to a process:

tasklist /FI "PID eq 1234"

Or run Resource Monitor (resmon.exe) and look under Network -> TCP Connections. Sysinternals TCPView/Process Explorer will also show process names for sockets (requires admin). Once you have the remote IP, perform a whois/ARIN lookup and a reverse DNS/AS lookup to confirm the address owner and whether it is statically assigned to a military range.

How to interpret what you find: a BitTorrent or other P2P client typically produces many short-lived connections to random ports and will show the P2P executable as the owning process (as suggested). A system or svchost-owned connection needs further inspection: list services for that PID (tasklist /svc) and capture a short packet trace with Wireshark or Microsoft Network Monitor to identify protocol fingerprints (P2P handshakes, HTTP, SSH, etc.).

Immediate remediation and next steps: temporarily disable or block the remote IP, stop suspected P2P software, disable file sharing, run updated AV and an anti‑malware/rootkit scan, and install all available OS patches (Vista reached end of support in 2017, so upgrading is strongly recommended). Preserve netstat output, process lists and a pcap if further investigation or reporting to an ISP/authority becomes necessary.

Recommended Answers

All 3 Replies

Member Avatar for DarkRubicant

This is no longer any good, the site has been sold by the owner to an advertising site.

Member Avatar for The Dude

Seems like they might be trying to cover this up

Interesting stuff on that page (And another interesting link linked from there also)

Member Avatar for TonyB

Wasn't this proven just to be normal traffic from using bit torrent and other applications like it. The same thing would happen on XP or even linux machines.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.