Jump to content


Photo

netstat


  • Please log in to reply
4 replies to this topic

#1 OhMyGod

OhMyGod

    Active Member

  • Active Members
  • 54 posts

Posted 06 September 2006 - 04:19 AM

Hi, just installed new router firmware and also Kaspersky AntiVirus and noticed something was weird.

Opened up cmd.exe and ran netstat.exe.

Noticed that there was a whole bunch of TCP Connections to my localhost once i opened up Firefox or some other proggie like MSN Messenger. It wasnt liddat in the past. Didnt have these whole load of connections to localhost.

Screenshot attached here.

Just wana ask if its normal. ahah.gif

Thanks in advance.

Attached Files


Edited by OhMyGod, 06 September 2006 - 06:41 AM.


#2 TheSentinel

TheSentinel

    The man in the dark

  • General Admin
  • 31,817 posts

Posted 06 September 2006 - 07:03 PM

QUOTE (OhMyGod @ Sep 6 2006, 06:19 AM) <{POST_SNAPBACK}>
Hi, just installed new router firmware and also Kaspersky AntiVirus and noticed something was weird.

Opened up cmd.exe and ran netstat.exe.

Noticed that there was a whole bunch of TCP Connections to my localhost once i opened up Firefox or some other proggie like MSN Messenger. It wasnt liddat in the past. Didnt have these whole load of connections to localhost.

Screenshot attached here.

Just wana ask if its normal. ahah.gif

Thanks in advance.



Hi OhMyGod

We need some more details bout that router and the KAV product you've installed or updated. Something you need to explain us: How didi you get that detailed netstat report without adding any parameters?

Thanks for your cooperation

Greetz
B. Udo

#3 OhMyGod

OhMyGod

    Active Member

  • Active Members
  • 54 posts

Posted 07 September 2006 - 07:05 AM

Thanks for the response dude!

Yeap, Im running on D-LINK 604 Router with latest 3.14 fw and just installed Kaspersky 6.0 (downloaded few days back from Kaspersky webbie).

I dont think any parameters was added to find the report. Just purely running cmd.exe from Start>Run and then typing in netstat.

cuz usually i dun see a bunch of localhost running (more than 10) when i run netstat.exe . Was quite shock to see that big list.

Thanks again for the assistance. :thumbup:

#4 TheSentinel

TheSentinel

    The man in the dark

  • General Admin
  • 31,817 posts

Posted 07 September 2006 - 09:13 AM

Hello OhMyGod

thanks for your reply. Did mix up that wit netstat and additional commands. Sure you'll get a list with all connections and if they are open to which port connected.

After checking my network connections at home and at work I've noticed the following:

* when refreshing f.e. a website and droping a netstat request you'll get all possible connections and about their status (listening, waiting etc.)

* after a short moment (f.e. 2 up to 3 mins.) drop a new netstat request. You'll notice that the list is much shorter cause only those connections are listed which are "in use"

If you've configured the firewall of ya D-Link router you shouldn't fear any "sniffers"

Have a great day
B. Udo

#5 OhMyGod

OhMyGod

    Active Member

  • Active Members
  • 54 posts

Posted 07 September 2006 - 02:21 PM

oh thanks for the help.

so issit normal to have a whole load of established localhost connections like those in the screenshots?

or do u also have witnessed this situation while testing out?