Results 1 to 3 of 3

Thread: What are these connections??

  1. #1
    jwirt Guest

    Default What are these connections??

    When I run netstat -r I get these connections to my computer. "My computer" is on a local LAN created by my Linksys router, which is connected to a cable modem.
    Three of these connections concern me (ports 1041, 1828, and 1829). What are they? How can I block them?
    C:\>netstat -aActive Connections
    Proto
    Local Address








    Foreign Address






    State

    TCP


    CLIENT656:epmap






    CLIENT656:0










    LISTENING

    TCP


    CLIENT656:microsoft-ds
    CLIENT656:0










    LISTENING

    TCP


    CLIENT656:1025







    CLIENT656:0










    LISTENING

    TCP


    CLIENT656:1030







    CLIENT656:0










    LISTENING

    TCP


    CLIENT656:1038







    CLIENT656:0










    LISTENING

    TCP


    CLIENT656:1041







    CLIENT656:0










    LISTENING

    TCP


    CLIENT656:netbios-ssn
    CLIENT656:0










    LISTENING

    TCP


    CLIENT656:1041







    216-166-75-24.fwd.datafoundry.com:https
    ESTABLISHED

    TCP


    CLIENT656:1828







    a204-2-177-41.deploy.akamaitechnologies.com:http
    TIME_WAIT

    TCP


    CLIENT656:1829







    a204-2-177-41.deploy.akamaitechnologies.com:http
    TIME_WAIT

    UDP


    CLIENT656:snmp







    *:*

    UDP


    CLIENT656:microsoft-ds
    *:*

    UDP


    CLIENT656:netbios-ns

    *:*

    UDP


    CLIENT656:netbios-dgm
    *:*

    UDP


    CLIENT656:isakmp





    *:*C:\>netstat -anActive Connections
    Proto
    Local Address








    Foreign Address






    State

    TCP


    0.0.0.0:135










    0.0.0.0:0












    LISTENING

    TCP


    0.0.0.0:445










    0.0.0.0:0












    LISTENING

    TCP


    0.0.0.0:1025









    0.0.0.0:0












    LISTENING

    TCP


    0.0.0.0:1030









    0.0.0.0:0












    LISTENING

    TCP


    0.0.0.0:1038









    0.0.0.0:0












    LISTENING

    TCP


    0.0.0.0:1041









    0.0.0.0:0












    LISTENING

    TCP


    192.168.1.100:139




    0.0.0.0:0












    LISTENING

    TCP


    192.168.1.100:1041



    216.166.75.24:443




    ESTABLISHED

    TCP


    192.168.1.100:1828



    204.2.177.41:80






    TIME_WAIT

    TCP


    192.168.1.100:1829



    204.2.177.41:80






    TIME_WAIT

    UDP


    0.0.0.0:161










    *:*

    UDP


    0.0.0.0:445










    *:*

    UDP


    192.168.1.100:137




    *:*

    UDP


    192.168.1.100:138




    *:*

    UDP


    192.168.1.100:500




    *:*

    Operating System:Windows 2000 Pro
    Product Name:ZoneAlarm Pro
    Software Version:6.1

  2. #2
    socalreviews Guest

    Default Re: What are these connections??

    If you knowingly or unknowingly installed any extra statistical or diagnostic software from your ISP's setup CD or from any web browser tool bar these communications could be outgoing data from that software. Many messaging programs from MSN or AOL also like to chatter through your internet connection. You will have to go through some of your active programs to see what is running and you can use the ZoneAlarm program control section to help track down the ones that are accessing the internet. Also try turning off any networking services that you are not using such as Client for Microsoft Networks and File and Print Sharing (I don't remember if Windows 2K is different but under Windows XP you go to Control Panel, Network Connections, and then right click on the Local Area Connection and/or the Wireless Connection icon then left click for connection properties). From your post it looks like you might also have other networking protocals along with netbios running. If you are not using those extra protocals or services you will want to turn those off or uncheck them from being active under those settings for your Network Connections. You only need to have TCP/IP enabled (QoS is ok also) to connect to the internet.

    You can look up the foreign IP addresses or any suspicious IP address at:

    http://www.arin.net/whois/

    Message Edited by SoCalReviews on 06-01-2006 01:51 PM

  3. #3
    cheapdude Guest

    Default Re: What are these connections??

    I just had same question when a clean install of Zonealarm Pro pooped up saying
    0.0.0.0 Port 135 wanted access.

    I came across this link in my travels during research. Seems like a good explaination and appears to be tied to www.grc.com which is another good site.

    http://www.sit.ulaval.ca/public/dex/...at_results.htm

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •