Results 1 to 3 of 3

Thread: SvcHost and incoming connections.

  1. #1
    kaju Guest

    Default SvcHost and incoming connections.

    Hello,

    I have been receiving two seperate requests for svchost to accept incoming connections.

    The first usually appears after I start the computer and svchost wants to accept incoming connections from port 135. The source IP address is 0.0.0.0. Please note that I have two computers in a local area network and the IP of the second computer is added as trusted.

    I believe the above request has something to do with the local network, not sure though.

    The alert log is the following:
    Description Generic Host Process for Win32 Services requested permission to access the internet.
    Rating High
    Date / Time 2008/09/04 10:03:42+3:00 GMT
    Type Repeat Server Program
    Program C:\WINDOWS\system32\svchost.exe
    Source IP 0.0.0.0:135
    Destination IP
    Direction Incoming (listen)
    Action Taken Blocked (once)
    Count 1
    Source DNS
    Destination DNS


    The second one appears randomly and in this case svchost wants to accept incoming connections from port 2056.

    I have no idea what this is.

    The alert log is the following:
    Description Generic Host Process for Win32 Services requested permission to access the internet.
    Rating High
    Date / Time 2008/09/04 11:13:16+3:00 GMT
    Type Repeat Server Program
    Program C:\WINDOWS\system32\svchost.exe
    Source IP 192.168.1.1:2056
    Destination IP
    Direction Incoming (accept)
    Action Taken Blocked (once)
    Count 1
    Source DNS
    Destination DNS

    Any advice?

    Thank you for your time.

    Operating System:Windows XP Pro
    Software Version:7.0
    Product Name:ZoneAlarm Pro

  2. #2
    kaju Guest

    Default Re: SvcHost and incoming connections.

    I forgot to mention that the incoming IP address on the second case is my router.

    As for the first instance I found a similar thread and it seems to be normal behaviour.

  3. #3
    Join Date
    Dec 2005
    Posts
    9,057

    Default Re: SvcHost and incoming connections.

    I figured if you read down a little further or checked the other boards, you would see your answer.

    As for the router connection
    see http://www.iana.org/assignments/port-numbers for the official list of ports.

    BUT keep in mind it is not the remote port of the incoming connection that is important in this particular situation, but the actual port of your computer that is accepting the incoming connections that is important. The remote outgoing port is not revelant in this case.

    I would take a guess and say yes this connection is okay, as it is your own router(s) and these are definitely not internet but trusted.

    Oldsod.
    Best regards.
    oldsod

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •