Some windows machine on our network is constantly broadcasting UDP packets to the port numbers 10019 and 10007. It also constantly changes its source port number. Seems suspicious to me, although I can't find any information of malware having this behavior. The content of the packages is always the same: Any thoughts? asked 02 Jun '12, 09:59  billybob |
5 Answers:
If I'd think that that kind of traffic is not to be expected as part of normal day to day operations, I would try to identify the machine first. You have the sending MAC address, so you can track it down by searching for it in the MAC address tables of your Switches. You might find that it lives on a port with a lot of other MAC addresses, which usually means that it is coming in from another switch - which means you have to track it down on the next switch and so on, until you find the definitive port. Then track the cabling to the PC that is connected at that port. On the PC, run answered 02 Jun '12, 10:16  Jasper ♦♦ I've tracked down the computer, and ran the command you told me. However, I can't find the udp port numbers listed in netstat. I think the best thing to do will be restoring a backup. Thanks for the help anyhow! (02 Jun '12, 10:42) billybob if it's UDP you will only see a process with netstat if it does a listen on that port. You won't see a process that's just sending data via UDP. You could install Microsoft Network Monitor 3.4. It's comparable to wireshark (with less/other features). Netmon will show the name and PID of the process that created the UDP packet. Maybe that helps to track down what is causing the broadcast traffic. (02 Jun '12, 13:06) Kurt Knochner ♦ |
You could also look into a couple of SysInternals tools, Process Monitor and TCPView, which despite the name does handle UDP as well. answered 03 Jun '12, 03:45  grahamb ♦ |
I would also try looking at wireshark output from another machine, maybe booting from a livecd and see if there is any communication from that possibly infected PC. answered 03 Jun '12, 13:19  pluribus |
I believe this could be the Steam Network client (a games network). I found several hints about very similar behaviour.
Logs from a Team Fortress 2 log server:
Please check if the Steam client is installed on the computer (192.168.8.192) who is sending those packets. Search the disk for Regards answered 04 Jul '12, 10:22  Kurt Knochner ♦ edited 04 Jul '12, 10:22 |
Hello, I found following: (on a PC Dell inspiron windows seven 64 bits) process C:\Program Files (x86)\Dell\Stage Remote\StageRemoteService.exe is the one who is responsible for sending those UDP frames on ports 10007 and 10019 every second. this process is part of program "dell stage remote" (by arcsoft) more info about it: (in french) http://content.dell.com/fr/fr/corp/d/press-releases/2011-07-27-nouvelle-version-de-stage i do not need it, and i could not find how to set it to off in windows services manager, so i inhibate it with following workaround: rename file C:\Program Files (x86)\Dell\Stage Remote\StageRemoteService.exe C:\Program Files (x86)\Dell\Stage Remote\StageRemoteService-DoNotRun.exe answered 05 Nov '12, 03:06  bcat Dell Stage Remote is a music/video streaming software.
(05 Nov '12, 04:24) Kurt Knochner ♦ |
Any updates on this one ? I just saw this thing happen on one of my networks and the only info I could find is this thread. I do not have physical access to that PC (guest laptop) but it looks highly suspicious.
can you please post a full capture of the traffic on cloudshark.org?
Sure thing - http://www.cloudshark.org/captures/a7174265ab29 It broadcasts every second...
There are also a suspicious LAN scan mixed in but I traced that back to McAfee (https://community.mcafee.com/thread/27750). The broadcasts seem to be unrelated.