WG311T wireless card is showing c.root-server.net and other root-server.net in netstat.

Dear Newsgroup,

Please can you help me to understand why when I "enable" the WG311T wirelss
network card that I start to see root-server.net in NETSTAT (network
activity)? I've searched the KB and FAQ on the www.netgear.com site and
cannot find anything about root servers on the site.

Here is an example of a netstat log:

Active Connections

Proto Local Address Foreign Address State
.........
TCP PC:1464 k.root-servers.net:domain TIME_WAIT
TCP PC:1466 h.root-servers.net:domain TIME_WAIT
TCP PC:1468 d.root-servers.net:domain TIME_WAIT
TCP PC:1469 old-j-root-servers-net.verisign-grs.net:domain
TIME_WAIT
..........

There are other entries but these look standard.

Do you know why the root-servers are in there?

Are they the same international DNS servers that all DNS requests are done
on?

Is there something on my computer like a virus/trojan that is trying to do a
DOS attack on the root servers?

I am running Anti-Virus and Zonealarm Firewall, as well as having a dummy IP
address on my routers in the DMZ (DeMilitarisedZone - where any
non-requested incoming probes get sent to). I've also worked in IT for over
7 years (software development and before that some support work) and I've
not seen this in NETSTAT before.

Regards,
Rob.

"Robert" <(E-Mail Removed)> wrote in message
news:427bb0f2$0$39069$(E-Mail Removed)...
> Please can you help me to understand why when I "enable" the WG311T
> wirelss network card that I start to see root-server.net in NETSTAT
> (network activity)? I've searched the KB and FAQ on the www.netgear.com
> site and cannot find anything about root servers on the site.
>
> Here is an example of a netstat log:

Actually, it would more correctly be called a "snapshot".

> Active Connections
>
> Proto Local Address Foreign Address State
> ........
> TCP PC:1464 k.root-servers.net:domain TIME_WAIT
> TCP PC:1466 h.root-servers.net:domain TIME_WAIT
> TCP PC:1468 d.root-servers.net:domain TIME_WAIT
> TCP PC:1469 old-j-root-servers-net.verisign-
>grs.net:domain TIME_WAIT
> .........
>
> There are other entries but these look standard.
>
> Do you know why the root-servers are in there?
>
> Are they the same international DNS servers that all DNS requests are done
> on?

If the names are believed, yes. (Although it's not really true to say that
they are servers that "all DNS requests are done on".)

> Is there something on my computer like a virus/trojan that is trying to do
> a DOS attack on the root servers?

Possibly, although not a very good one if the above is all there is. (Ever
seen netstat output on a machine with "Code Red" or similar, for example?)

> I am running Anti-Virus and Zonealarm Firewall, as well as having a dummy
> IP address on my routers in the DMZ (DeMilitarisedZone - where any
> non-requested incoming probes get sent to).

If you're running ZoneAlarm, you ought to be able to figure out what
application the connections are coming from. You could also google for
"fport".

I'd be interested to know what you find.

Alex