Odd connections

Hi all,

Dunno if anyone will have any ideas on this....i was looking at netstat and
found a shedload of connections.....to me???? -

TCP Laptop:1027 Laptop:4749 ESTABLISHED
TCP Laptop:1027 Laptop:4785 FIN_WAIT_2
TCP Laptop:1027 Laptop:4787 ESTABLISHED
TCP Laptop:1027 Laptop:4795 TIME_WAIT
TCP Laptop:1027 Laptop:4797 TIME_WAIT
TCP Laptop:1030 Laptop:1031 ESTABLISHED
TCP Laptop:1031 Laptop:1030 ESTABLISHED
TCP Laptop:3495 Laptop:1027 CLOSE_WAIT
TCP Laptop:4749 Laptop:1027 ESTABLISHED
TCP Laptop:4758 Laptop:1027 CLOSE_WAIT
TCP Laptop:4760 Laptop:1027 CLOSE_WAIT
TCP Laptop:4762 Laptop:1027 CLOSE_WAIT
TCP Laptop:4764 Laptop:1027 CLOSE_WAIT
TCP Laptop:4785 Laptop:1027 CLOSE_WAIT
TCP Laptop:4787 Laptop:1027 ESTABLISHED
TCP Laptop:4791 Laptop:8000 ESTABLISHED
TCP Laptop:8000 Laptop:4791 ESTABLISHED

Any guesses?

Cheers


---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.647 / Virus Database: 414 - Release Date: 29/03/2004

Port 1027 is officially reserved for ExoSee (http://www.exosee.com/ - ExoSee
peer-to-peer file sharing software) Occasionally you get some naughty
programs that use ports they haven't officially been assigned by IANA.
(Officially registered ports with the IANA:
ftp://ftp.iana.org/assignments/port-numbers )


To confirm:
At your prompt (depending on your OS, 2000/XP/2003 only) do: netstat -a -o

The right-hand most column will display a PID number 1-4 digits long.
Open task manager (ctrl+alt+del),
Choose the processes tab,
Choose View Menu > Select Columns...
Tick PID (Process Identifiation) to add that to your current view

Now, all you have to do is match up the PID number shown in your DOS box to
the PID number shown in task manager and you'll be able to see what program
is opening that port.

If it's SVCHOST.EXE, that means it's a Windows service in your Computer
Manager > Services console thats making that connection.



-Lawrence.



"monkeying......" <(E-Mail Removed)> wrote in message
news:5ODcc.158$nl6.59@newsfe1-win...
> Hi all,
>
> Dunno if anyone will have any ideas on this....i was looking at netstat
and
> found a shedload of connections.....to me???? -
>
> TCP Laptop:1027 Laptop:4749 ESTABLISHED
> TCP Laptop:1027 Laptop:4785 FIN_WAIT_2
> TCP Laptop:1027 Laptop:4787 ESTABLISHED
> TCP Laptop:1027 Laptop:4795 TIME_WAIT
> TCP Laptop:1027 Laptop:4797 TIME_WAIT
> TCP Laptop:1030 Laptop:1031 ESTABLISHED
> TCP Laptop:1031 Laptop:1030 ESTABLISHED
> TCP Laptop:3495 Laptop:1027 CLOSE_WAIT
> TCP Laptop:4749 Laptop:1027 ESTABLISHED
> TCP Laptop:4758 Laptop:1027 CLOSE_WAIT
> TCP Laptop:4760 Laptop:1027 CLOSE_WAIT
> TCP Laptop:4762 Laptop:1027 CLOSE_WAIT
> TCP Laptop:4764 Laptop:1027 CLOSE_WAIT
> TCP Laptop:4785 Laptop:1027 CLOSE_WAIT
> TCP Laptop:4787 Laptop:1027 ESTABLISHED
> TCP Laptop:4791 Laptop:8000 ESTABLISHED
> TCP Laptop:8000 Laptop:4791 ESTABLISHED
>
> Any guesses?
>
> Cheers
>
>
> ---
> Outgoing mail is certified Virus Free.
> Checked by AVG anti-virus system (http://www.grisoft.com).
> Version: 6.0.647 / Virus Database: 414 - Release Date: 29/03/2004
>
>

"Lawrence Stromski" <(E-Mail Removed)> wrote in message
news:c4v3h6$p3$(E-Mail Removed)...
> Port 1027 is officially reserved for ExoSee (http://www.exosee.com/ -
ExoSee
> peer-to-peer file sharing software) Occasionally you get some naughty
> programs that use ports they haven't officially been assigned by IANA.
> (Officially registered ports with the IANA:
> ftp://ftp.iana.org/assignments/port-numbers )
>
>
> To confirm:
> At your prompt (depending on your OS, 2000/XP/2003 only) do: netstat -a -o
>
> The right-hand most column will display a PID number 1-4 digits long.
> Open task manager (ctrl+alt+del),
> Choose the processes tab,
> Choose View Menu > Select Columns...
> Tick PID (Process Identifiation) to add that to your current view
>
> Now, all you have to do is match up the PID number shown in your DOS box
to
> the PID number shown in task manager and you'll be able to see what
program
> is opening that port.
>
> If it's SVCHOST.EXE, that means it's a Windows service in your Computer
> Manager > Services console thats making that connection.
>
>
>
> -Lawrence.
>
>
>
> "monkeying......" <(E-Mail Removed)> wrote in message
> news:5ODcc.158$nl6.59@newsfe1-win...
> > Hi all,
> >
> > Dunno if anyone will have any ideas on this....i was looking at netstat
> and
> > found a shedload of connections.....to me???? -
> >
> > TCP Laptop:1027 Laptop:4749 ESTABLISHED
> > TCP Laptop:1027 Laptop:4785 FIN_WAIT_2
> > TCP Laptop:1027 Laptop:4787 ESTABLISHED
> > TCP Laptop:1027 Laptop:4795 TIME_WAIT
> > TCP Laptop:1027 Laptop:4797 TIME_WAIT
> > TCP Laptop:1030 Laptop:1031 ESTABLISHED
> > TCP Laptop:1031 Laptop:1030 ESTABLISHED
> > TCP Laptop:3495 Laptop:1027 CLOSE_WAIT
> > TCP Laptop:4749 Laptop:1027 ESTABLISHED
> > TCP Laptop:4758 Laptop:1027 CLOSE_WAIT
> > TCP Laptop:4760 Laptop:1027 CLOSE_WAIT
> > TCP Laptop:4762 Laptop:1027 CLOSE_WAIT
> > TCP Laptop:4764 Laptop:1027 CLOSE_WAIT
> > TCP Laptop:4785 Laptop:1027 CLOSE_WAIT
> > TCP Laptop:4787 Laptop:1027 ESTABLISHED
> > TCP Laptop:4791 Laptop:8000 ESTABLISHED
> > TCP Laptop:8000 Laptop:4791 ESTABLISHED
> >
> > Any guesses?
> >
> > Cheers
> >
> >
> > ---
> > Outgoing mail is certified Virus Free.
> > Checked by AVG anti-virus system (http://www.grisoft.com).
> > Version: 6.0.647 / Virus Database: 414 - Release Date: 29/03/2004
> >
> >
>
>
Thanks for that......paranoid? me?


---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.647 / Virus Database: 414 - Release Date: 29/03/2004

If it is Local: Laptop to Remote: Laptop, you probably don't have anything
to worry about. It's the Local: Laptop to Remote:
microsofts.illegial.data.collection.server.microso ft.com you need to worry
about :-)


"monkeying......" <(E-Mail Removed)> wrote in message
news:QvEcc.172$(E-Mail Removed)...
>
> "Lawrence Stromski" <(E-Mail Removed)> wrote in message
> news:c4v3h6$p3$(E-Mail Removed)...
> > Port 1027 is officially reserved for ExoSee (http://www.exosee.com/ -
> ExoSee
> > peer-to-peer file sharing software) Occasionally you get some naughty
> > programs that use ports they haven't officially been assigned by IANA.
> > (Officially registered ports with the IANA:
> > ftp://ftp.iana.org/assignments/port-numbers )
> >
> >
> > To confirm:
> > At your prompt (depending on your OS, 2000/XP/2003 only) do:
netstat -a -o
> >
> > The right-hand most column will display a PID number 1-4 digits long.
> > Open task manager (ctrl+alt+del),
> > Choose the processes tab,
> > Choose View Menu > Select Columns...
> > Tick PID (Process Identifiation) to add that to your current view
> >
> > Now, all you have to do is match up the PID number shown in your DOS box
> to
> > the PID number shown in task manager and you'll be able to see what
> program
> > is opening that port.
> >
> > If it's SVCHOST.EXE, that means it's a Windows service in your Computer
> > Manager > Services console thats making that connection.
> >
> >
> >
> > -Lawrence.
> >
> >
> >
> > "monkeying......" <(E-Mail Removed)> wrote in message
> > news:5ODcc.158$nl6.59@newsfe1-win...
> > > Hi all,
> > >
> > > Dunno if anyone will have any ideas on this....i was looking at
netstat
> > and
> > > found a shedload of connections.....to me???? -
> > >
> > > TCP Laptop:1027 Laptop:4749 ESTABLISHED
> > > TCP Laptop:1027 Laptop:4785 FIN_WAIT_2
> > > TCP Laptop:1027 Laptop:4787 ESTABLISHED
> > > TCP Laptop:1027 Laptop:4795 TIME_WAIT
> > > TCP Laptop:1027 Laptop:4797 TIME_WAIT
> > > TCP Laptop:1030 Laptop:1031 ESTABLISHED
> > > TCP Laptop:1031 Laptop:1030 ESTABLISHED
> > > TCP Laptop:3495 Laptop:1027 CLOSE_WAIT
> > > TCP Laptop:4749 Laptop:1027 ESTABLISHED
> > > TCP Laptop:4758 Laptop:1027 CLOSE_WAIT
> > > TCP Laptop:4760 Laptop:1027 CLOSE_WAIT
> > > TCP Laptop:4762 Laptop:1027 CLOSE_WAIT
> > > TCP Laptop:4764 Laptop:1027 CLOSE_WAIT
> > > TCP Laptop:4785 Laptop:1027 CLOSE_WAIT
> > > TCP Laptop:4787 Laptop:1027 ESTABLISHED
> > > TCP Laptop:4791 Laptop:8000 ESTABLISHED
> > > TCP Laptop:8000 Laptop:4791 ESTABLISHED
> > >
> > > Any guesses?
> > >
> > > Cheers
> > >
> > >
> > > ---
> > > Outgoing mail is certified Virus Free.
> > > Checked by AVG anti-virus system (http://www.grisoft.com).
> > > Version: 6.0.647 / Virus Database: 414 - Release Date: 29/03/2004
> > >
> > >
> >
> >
> Thanks for that......paranoid? me?
>
>
> ---
> Outgoing mail is certified Virus Free.
> Checked by AVG anti-virus system (http://www.grisoft.com).
> Version: 6.0.647 / Virus Database: 414 - Release Date: 29/03/2004
>
>