Any way to tell which internal IP uses certain ports?

[Syringer]

We got a notice at our business account that torrents were being used, and it shows that it was on port: 39191.

Any way to track it back to the internal IP that it belongs to? e.g. 192.168.1.39

 

[imagoon]

Look up the NAT mapping in the firewall. You do send all of that to a syslog right?

Reviewing Netflow data for that time period also may help since torrents are normally pretty obvious there also.

 

[Syringer]

Ah yes that did it. We located it to 192.168.1.112 Thanks!

 

[XavierMace]

LOL, we had this happen in our office recently too. How do people think this is OK?