I was running fiddler and suddenly I see requests this requests to   hxxp://zc.qq.com/cgi-bin/chs/numreg/init?  and  hxxp://www.baidu.com/cache/global/img/gs-2.0.gif  But no process is shown. How do I Identify which process made the requests. This seem to be tracking requests. Both request's responses try to set cookies. But I don't remember installing anything related to qq and baidu. More Information: I stay in India. OS: Win7.1    This requests seem to be repeated after around 6 minutes I tried TCPView.
123287
Is it possible to catch, which program is accessing a specific IP address?   I found my computer is flooding and wish to check addresses one by one.  May be it is possible to set up some audit for this?
119506
I've seen this question already:   I remember that Chrome used to do this if you go to the History view and enter a query in the search box there.  However, it's not working for me anymore. I can't find anything now!  Did Chrome stopped doing this? Am I missing something? Do I have to enable/disable something?
25588
There is a tiny window that I am unable to identify or close. It is big enough for me to move but I can't seem to stretch it to make it bigger, I can't close it. It does not appear to be any of the items listed as Applications in the Task Manager.  Is there any sort of program that allows me to identify a process by clicking on the window of the application?  I really want to know what this is. If I log out it goes away but something I am doing is causing it to re-appear.  Any ideas how best to troubleshoot it?
17526
I think I'm being the victim of a bug here. Sometimes while I'm working (I still don't know why), my network traffic goes up to 200 KB/s and stays that way, even tough I'm not doing anything internet-related.   This sometimes happens to me with the CPU usage. When it does, I just run a top command to find out which process is responsible and then kill it. Problem is: I have no way of knowing which process is responsible for my high network usage. Both the resource monitor and the top command only tell me my total network usage, neither of them tells me process specific network info.  I've found questions here about monitoring total bandwidth usage, but, as I mentioned, that's not what I need. Is there another command I can use to find out which process is getting out of hand?  The command iftop gives results that disagree entirely with the information reported by System Monitor. While the latter claims there's high network traffic, the former claims there's barely 1 KB/s.  I've already tried killing all the obvious ones (Firefox, update-manager, Pidgin, etc) with no luck. So far, restarting the machine is the only way I found of getting rid of the issue.
75907
In reviewing a post in the reopen queue, I came across the following.        (The review in question is )  I don't see anything jumping out at me as a cause, so it could be browser related (just a wild guess though)  Browser: Chrome 43.0.2357.132 m OS: Windows 8.1
18444
Yesterday we got hit by a DDoS attack reaching our webserver backends (apache2). The frontend consists of haproxy loadbalancing connections to the webservers. On access.log of apache we saw thousands of requests from two ips and after a couple of hours we realized that those were fake/spoofed and were not the actual ips.  For clarification reasons, we did a "curl GET /" with an ip of "137.137.136.136" and indeed that's the ip (fake one) we saw in our weblogs  Now, in another cluster where we use nginx as reverse proxy, changing/crafting the X-Forwarded-For Header doesn't work. Meaning , even if you enter a random ip in the specific header nginx will still pass the correct ip to the backend webserver?  Does this has to do with haproxy? Anyone can confirm that crafted X-Forwarded-For headers can pass through haproxy? Why is this not happening in nginx ? How do you prevent this?
102106
The problem is a whole load of 404 errors, as reported by Google Webmaster Tools, with pages and queries that have never been there. One of them is viewtopic.php, and I've also noticed a scary number of attempts to check if the site is a WordPress site (wp_admin) and for the cPanel login. I block TRACE already, and the server is equipped with some defense against scanning/hacking. However, this doesn't seem to stop. The referrer is, according to Google Webmaster, totally.me.  I have looked for a solution to stop this, because it isn't certainly good for the poor real actual users, let alone the SEO concerns.  I am using the Perishable Press mini black list (), a standard referrer blocker (for porn, herbal, casino sites), and even some software to protect the site (XSS blocking, SQL injection, etc). The server is using other measures as well, so one would assume that the site is safe (hopefully), but it isn't ending.  Does anybody else have the same problem, or am I the only one seeing this? Is it what I think, i.e., some sort of attack? Is there a way to fix it, or better, prevent this useless resource waste?  EDIT I've never used the question to thank for the answers, and hope this can be done. Thank you all for your insightful replies, which helped me to find my way out of this. I have followed everyone's suggestions and implemented the following:   a honeypot a script that listens to suspect urls in the 404 page and sends me an email with user agent/ip, while returning a standard 404 header a script that rewards legitimate users, in the same 404 custom page,  in case they end up clicking on one of those urls. In less than 24 hours I have been able to isolate some suspect IPs, all listed in Spamhaus. All the IPs logged so far belong to spam VPS hosting companies.   Thank you all again, I would have accepted all answers if I could.
58452
, I know that 100 HNQs are sorted by &quot;hotness points&quot;, in descending order. However, this order is not used when displaying HNQ in the sidebar on various sites. (Or for the one single HNQ which is displayed in the feed of the mobile apps.) Neither is there enough space to display all the HNQs in the sidebar at once, so only a selection is shown. So how are these picked, and how is the order determined ?  Is it a totally random selection and ordering of the current HNQs? Will all users see the same HNQs on any given page at a particular time? Does number of &quot;hotness points&quot; affect the likeliness that a certain HNQ will be displayed on a page? Will the system rotate the HNQs across different pages so that all can be seen? Are there other factors?
50689
I am facing a load average of > 3 since past 2 days. The CPU utilization is never above 40 % in all cases. Here are some screenshots of Server Density monitoring tool that I use.    The process snapshot at the highest peak, @ 0:00 is as follows:   And the process snapshot at the peak created at 12:00 is:   My question is, even though CPU utilization is not 100 %, why am I facing a high average?  PS: All snapshots are sorted by descending CPU utilization.
83549
When I login to my ubuntu system, it show me this this message, How can I see it any time? I tried to run . .bashrc but it didn't worked.   Welcome to Ubuntu 12.10 LTS (GNU/Linux 3.2.0-24-virtual x86_64)   * Documentation:  https://help.ubuntu.com/    System information as of Sat Jul 13 06:16:35 UTC 2013    System load:  0.55              Processes:           96   Usage of /:   8.1% of 68.74GB   Users logged in:     0   Memory usage: 55%               IP address for eth0: 198.xx.xxx.xxx   Swap usage:   0%                IP address for eth1: xxx.1x0.xx.xxx    =&gt; There is 1 zombie process.    Graph this data and manage this system at https://landscape.canonical.com/  223 packages can be updated. 134 updates are security updates.  Last login: Mon Jul  8 17:47:05 2013
17029
We suspect we have had a data breach, but we are not sure how to investigate it to determine the source of the breach or what data was sent.  We have an app service that has been running for a while with steady usage. We noticed that over the last couple of nights there have been large spikes in data out. Our website has an authenticated user area and we are concerned that there may have been a breach or something unauthorized happening on the site.  The site has consistently always had below 10MB/15mins Data Out. But the sudden spike was over 180MB then instantly back down again. The second night the spike was 600MB. In the same 15 minute metric window the Average CPU time spiked to over one hour. Response time, number of requests and 4xx/5xx errors all remained steady.     Is there a way using Azure (Metrics or Security Center) to determine what caused the massive spike in Data Out? What data was sent, who it was sent to etc? Is there anything we can enable within Azure to allow us to view this data if it was to happens again tonight? (e.g. Azure Sentinel)  Looking at other metrics, there was no obvious spike in 4XX or 5XX errors or number of requests, so we do not suspect a brute force or DoS attack.
122142
I am using Ubuntu 17.10 on my desktop PC, I've been monitoring network traffic with Etherape. I noticed HTTP requests from my PC(casa hostname) to googleusercontent.com (104.198.143.177). So I used lsof and ss to 'identify' process behind these requests.    Using lsof -i:   NetworkMa  778            root   20u  IPv4 546772      0t0  TCP casa:53671-&gt;177.143.198.104.bc.googleusercontent.com:http (SYN_SENT) NetworkMa  778            root   20u  IPv4 546772      0t0  TCP casa:53671-&gt;177.143.198.104.bc.googleusercontent.com:http (ESTABLISHED)   Using ss -rep dst 104.198.143.177:    tcp    SYN-SENT   0      1      casa%enp4s0:53671    177.143.198.104.bc.googleusercontent.com:http  users:(("NetworkManager",pid=778,fd=20)) timer:(on,964ms,0) ino:546772 sk:6df &lt;-&gt; tcp    ESTAB      0      87     casa%enp4s0:53671    177.143.198.104.bc.googleusercontent.com:http  users:(("NetworkManager",pid=778,fd=20)) timer:(on,300ms,0) ino:546772 sk:6df &lt;-&gt;   It seems NetworkManager (pid 778) is sending requests to googleusercontent, and it happens every 5 minutes exactly.   I have to say, no applications were launched at the moment, no background process, no network activities,no online account and it was a 'Ubuntu fresh install'. So why NM would sent requests to googleusercontent?
31161
I'm using WinXP, and I notice that in the Task Manager, on the Performance tab my CPU usage is 100%.  But When I go to the Processes tab, and sort by CPU System Idle Process is taking up 90%.  I've double checked that things like AVG anti-virus isn't actively scanning, and that jkdefrag is not defragging.  But I know something is taking CPU cycles, because the machine is very slow.  How do I determine which process is hammering the CPU if it doesn't show in the Process List?
118493
I'm able to find processes using top or ps. That's no problem.  Sometimes I find that some processes are taking up a lot of memory or cpu and I'm trying to identify what the root program is.  For instance, the process sort sometimes just ends up taking 2-3 gigs of memory over like 4 hours. I'd like to know what program initiated the sort process so I can try and fix it.
6945
When looking at my Apache2 access logs, I occasionally see GET requests asking my server for a page on a completely different server. For example:  xx.xx.xx.xx - - [18/Jan/2012:07:12:10 -0500] "GET http://someotherserver.com/?sometimesmorestuff=likethis HTTP/1.1" 200 389 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8.1.12) Gecko/20080201 Firefox/2.0.0.12"   I remembered reading something about that in the past, but at the time I had never seen that on my server, so I didn't worry about it.   Now that I am seeing it on my server, I just ran a test and it appears that my site does indeed serve requests for content from other servers. This seems like a bad thing. So, two questions:  A) Is this something I should be worrying about?  B) How can I fix it?  I've tried a little Googling, but I don't even know what this sort of thing is called, and that makes it difficult.
86431
I am having problems starting my Apache server, because port 443 is already in use.  It turns out, the system process (PID 4) uses the port 443. I don't have IIS installed, the services.msc shows (predictably) no Exchange server running, nor WWW-Services, nor IIS. I have no idea how to find out what service uses that port, short of just disabling each service one after the other, and I am not even sure that would help.  I would be grateful if someone could point me towards how I can get my SSL port back, thank you :)  P.S.: Of course "just switch Apache to another port for SSL" would solve the problem of not being able to start Apache. But I'd still like to know what is so insistent about hogging port 443. :)    I by now took the 'hard route' and disabled services one after the other. It turned out that the "Routing and RAS" service was the culprit.  Thank you all for the valuable input and the new tools in the combat against "WTF does my system do now?".
21521
I have a case where a query I'm running is taking a long time.  When I checked sys.dm_exec_requests the blocking_session_id is a negative value, -2 to be specific.  The wait is a LCK_M_X and the blocked command is a DELETE statement.  To the best of my knowledge nothing else is touching that table at the moment.  In fact the only active requests are the blocked connection and the query checking sys.dm_exec_requests.  When I look at sys.dm_tran_session_transactions the blocked session is the only one showing up.