What's opening these connections?

Not sure what group this should be posted to so appologies in advance!

Running ie 5.5 (sp2)

I wonder if anybody can shed some light on this problem. My PC seems to be
opening connections randomly to various port no's

Some netstat results (p1900 is name of my PC as if you wouldn't know that
anyway!) -

So after system reboot -

Active Connections

Proto Local Address Foreign Address State

After reboot & One browser window open at www.google.com

Active Connections

Proto Local Address Foreign Address State
TCP p1900:1027 p1900:1031 ESTABLISHED
TCP p1900:1027 p1900:1034 ESTABLISHED
TCP p1900:1031 p1900:1027 ESTABLISHED
TCP p1900:1034 p1900:1027 ESTABLISHED
TCP p1900:1032 66.102.11.99:http ESTABLISHED
TCP p1900:1035 216.239.59.104:http ESTABLISHED

Port no's are not always consistant, for example close & reopen browser -

Active Connections

Proto Local Address Foreign Address State
TCP p1900:1027 p1900:1039 ESTABLISHED
TCP p1900:1027 p1900:1041 ESTABLISHED
TCP p1900:1039 p1900:1027 ESTABLISHED
TCP p1900:1041 p1900:1027 ESTABLISHED
TCP p1900:1040 66.102.11.99:http ESTABLISHED
TCP p1900:1042 216.239.59.104:http ESTABLISHED

I have no idea why? - closing anti-virus (pc-cillin + firewall), spyweeper &
anything else network related i.e Oracle, doesn't make any difference!

System has been virus checked, de-spywared loads of times so it's highly
unlikely its one of those?

Please has anyone any ideas as to what might be causing this?

many thanks

harry

Use netstat -o this will give you the process ID that is related to the
local port number. Then goto Taskmanger> Processes (sometimes you have to
add the PID column, VIEW menu> OPTIONS) and see what executable is related
to the PID, then do a search for it and check who's EXE it is in properties.

"Harry" <(E-Mail Removed)> wrote in message
news:%(E-Mail Removed)...
> Not sure what group this should be posted to so appologies in advance!
>
> Running ie 5.5 (sp2)
>
> I wonder if anybody can shed some light on this problem. My PC seems to be
> opening connections randomly to various port no's
>
> Some netstat results (p1900 is name of my PC as if you wouldn't know that
> anyway!) -
>
> So after system reboot -
>
> Active Connections
>
> Proto Local Address Foreign Address State
>
> After reboot & One browser window open at www.google.com
>
> Active Connections
>
> Proto Local Address Foreign Address State
> TCP p1900:1027 p1900:1031 ESTABLISHED
> TCP p1900:1027 p1900:1034 ESTABLISHED
> TCP p1900:1031 p1900:1027 ESTABLISHED
> TCP p1900:1034 p1900:1027 ESTABLISHED
> TCP p1900:1032 66.102.11.99:http ESTABLISHED
> TCP p1900:1035 216.239.59.104:http ESTABLISHED
>
> Port no's are not always consistant, for example close & reopen browser -
>
> Active Connections
>
> Proto Local Address Foreign Address State
> TCP p1900:1027 p1900:1039 ESTABLISHED
> TCP p1900:1027 p1900:1041 ESTABLISHED
> TCP p1900:1039 p1900:1027 ESTABLISHED
> TCP p1900:1041 p1900:1027 ESTABLISHED
> TCP p1900:1040 66.102.11.99:http ESTABLISHED
> TCP p1900:1042 216.239.59.104:http ESTABLISHED
>
> I have no idea why? - closing anti-virus (pc-cillin + firewall), spyweeper
&
> anything else network related i.e Oracle, doesn't make any difference!
>
> System has been virus checked, de-spywared loads of times so it's highly
> unlikely its one of those?
>
> Please has anyone any ideas as to what might be causing this?
>
> many thanks
>
> harry
>
>
>

-o ? all I have is -a -e -n -p -r -s (this is with win 2000 (sp4) netstat)



"Gino" <(E-Mail Removed)> wrote in message
news:c4ef1$40211ebb$44a77c62$(E-Mail Removed) ervers.com...
> Use netstat -o this will give you the process ID that is related to the
> local port number. Then goto Taskmanger> Processes (sometimes you have to
> add the PID column, VIEW menu> OPTIONS) and see what executable is related
> to the PID, then do a search for it and check who's EXE it is in
properties.
>
> "Harry" <(E-Mail Removed)> wrote in message
> news:%(E-Mail Removed)...
> > Not sure what group this should be posted to so appologies in advance!
> >
> > Running ie 5.5 (sp2)
> >
> > I wonder if anybody can shed some light on this problem. My PC seems to
be
> > opening connections randomly to various port no's
> >
> > Some netstat results (p1900 is name of my PC as if you wouldn't know
that
> > anyway!) -
> >
> > So after system reboot -
> >
> > Active Connections
> >
> > Proto Local Address Foreign Address State
> >
> > After reboot & One browser window open at www.google.com
> >
> > Active Connections
> >
> > Proto Local Address Foreign Address State
> > TCP p1900:1027 p1900:1031 ESTABLISHED
> > TCP p1900:1027 p1900:1034 ESTABLISHED
> > TCP p1900:1031 p1900:1027 ESTABLISHED
> > TCP p1900:1034 p1900:1027 ESTABLISHED
> > TCP p1900:1032 66.102.11.99:http ESTABLISHED
> > TCP p1900:1035 216.239.59.104:http ESTABLISHED
> >
> > Port no's are not always consistant, for example close & reopen
browser -
> >
> > Active Connections
> >
> > Proto Local Address Foreign Address State
> > TCP p1900:1027 p1900:1039 ESTABLISHED
> > TCP p1900:1027 p1900:1041 ESTABLISHED
> > TCP p1900:1039 p1900:1027 ESTABLISHED
> > TCP p1900:1041 p1900:1027 ESTABLISHED
> > TCP p1900:1040 66.102.11.99:http ESTABLISHED
> > TCP p1900:1042 216.239.59.104:http ESTABLISHED
> >
> > I have no idea why? - closing anti-virus (pc-cillin + firewall),
spyweeper
> &
> > anything else network related i.e Oracle, doesn't make any difference!
> >
> > System has been virus checked, de-spywared loads of times so it's highly
> > unlikely its one of those?
> >
> > Please has anyone any ideas as to what might be causing this?
> >
> > many thanks
> >
> > harry
> >
> >
> >
>
>

Sorry for that. Here is a freeware download "Active Ports" that I use that
will show the IP, Ports. PID, Protocol, and the Path to the EXE.
http://www.ntutility.com/freeware.html

If the EXE for the local port is "SVCHOST.EXE" , this is a Microsoft
program that runs .DLL's in there own process (like RPC service) or in
pooled processes and is listed several times in TaskManager. To see what
..DLL's are running in these PID you have to use a utility.
http://support.microsoft.com/default...b;en-us;250320

"Harry" <(E-Mail Removed)> wrote in message
news:%(E-Mail Removed)...
> Not sure what group this should be posted to so appologies in advance!
>
> Running ie 5.5 (sp2)
>
> I wonder if anybody can shed some light on this problem. My PC seems to be
> opening connections randomly to various port no's
>
> Some netstat results (p1900 is name of my PC as if you wouldn't know that
> anyway!) -
>
> So after system reboot -
>
> Active Connections
>
> Proto Local Address Foreign Address State
>
> After reboot & One browser window open at www.google.com
>
> Active Connections
>
> Proto Local Address Foreign Address State
> TCP p1900:1027 p1900:1031 ESTABLISHED
> TCP p1900:1027 p1900:1034 ESTABLISHED
> TCP p1900:1031 p1900:1027 ESTABLISHED
> TCP p1900:1034 p1900:1027 ESTABLISHED
> TCP p1900:1032 66.102.11.99:http ESTABLISHED
> TCP p1900:1035 216.239.59.104:http ESTABLISHED
>
> Port no's are not always consistant, for example close & reopen browser -
>
> Active Connections
>
> Proto Local Address Foreign Address State
> TCP p1900:1027 p1900:1039 ESTABLISHED
> TCP p1900:1027 p1900:1041 ESTABLISHED
> TCP p1900:1039 p1900:1027 ESTABLISHED
> TCP p1900:1041 p1900:1027 ESTABLISHED
> TCP p1900:1040 66.102.11.99:http ESTABLISHED
> TCP p1900:1042 216.239.59.104:http ESTABLISHED
>
> I have no idea why? - closing anti-virus (pc-cillin + firewall), spyweeper
&
> anything else network related i.e Oracle, doesn't make any difference!
>
> System has been virus checked, de-spywared loads of times so it's highly
> unlikely its one of those?
>
> Please has anyone any ideas as to what might be causing this?
>
> many thanks
>
> harry
>
>
>

"Harry" <(E-Mail Removed)> wrote in message
news:#(E-Mail Removed)...
> Proto Local Address Foreign Address State
> TCP p1900:1027 p1900:1031 ESTABLISHED
> TCP p1900:1027 p1900:1034 ESTABLISHED
> TCP p1900:1031 p1900:1027 ESTABLISHED
> TCP p1900:1034 p1900:1027 ESTABLISHED
> TCP p1900:1032 66.102.11.99:http ESTABLISHED
> TCP p1900:1035 216.239.59.104:http ESTABLISHED

Only the last two lines are relevant. The port is consistant, http is
port "80" and it is the same for both lines. The Source Port (aka
Client Port, aka Local Address Port) is always random, that is the way
TCP/IP works.

The first 4 lines are internal communications within your machine
itself, notice both the Local and Foreign address is the same (p1900).
It is simply talking to itself,...bad for humans, ....perfectly normal
for computers.

--

Phillip Windell [CCNA, MVP, MCP]
WAND-TV (ABC Affiliate)
www.wandtv.com

thanks to all that replied - makes a bit more sense now!

"Harry" <(E-Mail Removed)> wrote in message
news:#(E-Mail Removed)...
> Not sure what group this should be posted to so appologies in advance!
>
> Running ie 5.5 (sp2)
>
> I wonder if anybody can shed some light on this problem. My PC seems to be
> opening connections randomly to various port no's
>
> Some netstat results (p1900 is name of my PC as if you wouldn't know that
> anyway!) -
>
> So after system reboot -
>
> Active Connections
>
> Proto Local Address Foreign Address State
>
> After reboot & One browser window open at www.google.com
>
> Active Connections
>
> Proto Local Address Foreign Address State
> TCP p1900:1027 p1900:1031 ESTABLISHED
> TCP p1900:1027 p1900:1034 ESTABLISHED
> TCP p1900:1031 p1900:1027 ESTABLISHED
> TCP p1900:1034 p1900:1027 ESTABLISHED
> TCP p1900:1032 66.102.11.99:http ESTABLISHED
> TCP p1900:1035 216.239.59.104:http ESTABLISHED
>
> Port no's are not always consistant, for example close & reopen browser -
>
> Active Connections
>
> Proto Local Address Foreign Address State
> TCP p1900:1027 p1900:1039 ESTABLISHED
> TCP p1900:1027 p1900:1041 ESTABLISHED
> TCP p1900:1039 p1900:1027 ESTABLISHED
> TCP p1900:1041 p1900:1027 ESTABLISHED
> TCP p1900:1040 66.102.11.99:http ESTABLISHED
> TCP p1900:1042 216.239.59.104:http ESTABLISHED
>
> I have no idea why? - closing anti-virus (pc-cillin + firewall), spyweeper
&
> anything else network related i.e Oracle, doesn't make any difference!
>
> System has been virus checked, de-spywared loads of times so it's highly
> unlikely its one of those?
>
> Please has anyone any ideas as to what might be causing this?
>
> many thanks
>
> harry
>
>
>