Re: [Vol-users] connscan ouput question
3 Mar
2010
3 Mar
'10
4:05 p.m.
Hey William,
The scanning modules attempt to extract artifacts at the physical address
layer of abstraction. Basically, they are attempting to carve objects. As
a result, they can occasionally have FPs if the data in question resembles
a valid object, which appears to be what is happening.
Thanks,
AW
On Tue, 2 Mar 2010, Schroeder, William wrote:
I am resending this as it seems the mail was munged on
my end--
Has anyone seen the following on the output from connscan? The connections are both
external and the PID is impossibly high.
Local Address Remote Address Pid
------------------------- ------------------------- ------
Snip
73.0.83.0:20992 69.0.71.0:21504 6029401
snip