Viewing TCP listeners information
View TCP listener information.
About this task
The TCP listeners table provides a detailed list of systems that are in the listening state.
When a connection is in the listen state an end point system is waiting for a returning handshake (SYN).The normal listening state should be very transient, changing all of the time.
Two or more systems going to a common system in an extended listening state indicates the need for further investigation.
End systems in an extended listening state can indicate a broken TCP connection or a DOS attack on a resource.
This type of DOS attack, known as a SYN attack, results from the transmission of SYNs with no response to return replies.
While many systems can detect a SYN attack, the TCP listener statistics can provide additional forensic information.
Procedure
- In the navigation pane, expand the folders.
- ClickTCP/UDP.
- Click the TCP Listeners tab.
TCP Listeners field descriptions
Use the data in the following table to use the TCP Listeners tab.
Name | Description |
|---|---|
LocalAddressType | Displays the type (IPv6 or IPv4) for the address in the LocalAddress field. |
LocalAddress | Displays the IPv6 address for the TCP connection. |
LocalPort | Displays the local port number for the TCP connection. |
Process | Displays the process ID for the system process associated with the TCP connection. |