How to stop unknown IP sending from Windows server

Question

Windows server keep sending data to the following unknown ip.

40.70.184.83
40.74.108.123
239.255.255.250/1900
13.107.4.52/80
13.67.116.41/443
204.79.197.200/443
168.63.154.101
168.63.202.111
117.18.232.240/80

Anyone knows how to stop the IP sending?thank you.

Answer 1

Hi ,

How do you know that the server is sending packets to these IP addresses? When you see that the server is sending packets to these IP addresses, you should be able to find the corresponding process.

Yes, we can only monitor the traffic in real time. There is no such tool or build-in way could monitor the disconnected connection.

(鉴于之前有过中文交流：没有这么智能的工具可以捕获已经断开连接的数据的，所以最简单也是最好的方法还是建议一直开着network monitor，过一段时间之后关掉看到底是什么进程在发这些数据包的，没有什么其他更好的方法。如果是三方的程序在向这些IP地址发数据包的话，可以联系三方去咨询如何停止发送数据包，如果是我们的程序的话，可以随时开新帖咨询。)

Please Accept as answer if the reply is helpful.

Best Regards,

Candy

Answer 2

Hi ,

Simply, please first use task manager to open resource monitor and then see which process is sending traffic to these IP address. As the picture below:

If the process belongs to third-party application, please contact third-party application to learn how to stop the IP sending.

If not, please tell us which process is sending data to these IP address.

If you cannot see these traffic from resource monitor, then you need to use network monitor to find the process.

Here is the download link of network monitor :

https://www.microsoft.com/en-us/download/details.aspx?id=4865

Note: Due to the community's security policy, analysis of network traffic is beyond community support level.

Best Regards,

Candy