4 replies to this topic

[OhMyGod]

Hi, just installed new router firmware and also Kaspersky AntiVirus and noticed something was weird.

Opened up cmd.exe and ran netstat.exe.

Noticed that there was a whole bunch of TCP Connections to my localhost once i opened up Firefox or some other proggie like MSN Messenger. It wasnt liddat in the past. Didnt have these whole load of connections to localhost.

Screenshot attached here.

Just wana ask if its normal.

Thanks in advance.

Attached Files

•  weirdo.GIF   17.45KB   68 downloads
•  weirdo2.GIF   28.33KB   51 downloads

Edited by OhMyGod, 06 September 2006 - 06:41 AM.

[TheSentinel]

Hi, just installed new router firmware and also Kaspersky AntiVirus and noticed something was weird.

Opened up cmd.exe and ran netstat.exe.

Noticed that there was a whole bunch of TCP Connections to my localhost once i opened up Firefox or some other proggie like MSN Messenger. It wasnt liddat in the past. Didnt have these whole load of connections to localhost.

Screenshot attached here.

Just wana ask if its normal.

Thanks in advance.

Hi OhMyGod

We need some more details bout that router and the KAV product you've installed or updated. Something you need to explain us: How didi you get that detailed netstat report without adding any parameters?

Thanks for your cooperation

Greetz
B. Udo

[OhMyGod]

Thanks for the response dude!

Yeap, Im running on D-LINK 604 Router with latest 3.14 fw and just installed Kaspersky 6.0 (downloaded few days back from Kaspersky webbie).

I dont think any parameters was added to find the report. Just purely running cmd.exe from Start>Run and then typing in netstat.

cuz usually i dun see a bunch of localhost running (more than 10) when i run netstat.exe . Was quite shock to see that big list.

Thanks again for the assistance. :thumbup:

[TheSentinel]

Hello OhMyGod

thanks for your reply. Did mix up that wit netstat and additional commands. Sure you'll get a list with all connections and if they are open to which port connected.

After checking my network connections at home and at work I've noticed the following:

* when refreshing f.e. a website and droping a netstat request you'll get all possible connections and about their status (listening, waiting etc.)

* after a short moment (f.e. 2 up to 3 mins.) drop a new netstat request. You'll notice that the list is much shorter cause only those connections are listed which are "in use"

If you've configured the firewall of ya D-Link router you shouldn't fear any "sniffers"

Have a great day
B. Udo

[OhMyGod]

oh thanks for the help.

so issit normal to have a whole load of established localhost connections like those in the screenshots?

or do u also have witnessed this situation while testing out?