GIAC Certified Incident Handler (GCIH) — Question 88

You work as a Network Administrator for InformSec Inc. You find that the TCP port number 23476 is open on your server. You suspect that there may be a Trojan named Donald Dick installed on your server. Now you want to verify whether Donald Dick is installed on it or not. For this, you want to know the process running on port 23476, as well as the process id, process name, and the path of the process on your server. Which of the following applications will you most likely use to accomplish the task?

Answer options

• A. Tripwire
• B. SubSeven
• C. Netstat
• D. Fport

Correct answer: D

Explanation

Fport is specifically designed to identify the processes associated with open ports, making it the most suitable choice for this task. While Netstat can display open ports and associated processes, it doesn't provide detailed information such as the process path. Tripwire and SubSeven are not relevant for identifying processes on specific ports.