SOLVED: How to Determine What is Using LDAPS

If you have LDAPS on your Domain Controllers, you might want to know what is using it. In our case, we had a new customer with an partially configured LDAPS and we wanted to know what, if anything, was even trying to use it.

The solution is to use WireShark and and easy filter:

1. Download and install both:
   • NPCap for WireShark HERE
   • WireShark HERE
     • We typically use WireShark Portable to avoid a full install on a clients servers
2. Launch WireShark and select the NIC in use (usually the first one)
3. Enter TCP.PORT == 636 in the FILTER box at the top (See screenshot below)
4. Click the blue shark fin icon to start the capture
5. Wait at least 5 minutes to see any there any traffic (we waited 45 minutes)
6. Look at the SOURCE and DESTINATION IP addresses to figure out what is taking to what