Listening ports?!

From: Alsvik, Ture (spam_at_alsvik.dk)
Date: 08/18/03


Date: Mon, 18 Aug 2003 00:00:00 +0200

C:\>netstat -a

Active Connections

  Proto Local Address Foreign Address State
  TCP w2k_machine:ftp w2k_machine:0 LISTENING
  TCP w2k_machine:smtp w2k_machine:0 LISTENING
  TCP w2k_machine:http w2k_machine:0 LISTENING
  TCP w2k_machine:pop3 w2k_machine:0 LISTENING
  TCP w2k_machine:epmap w2k_machine:0 LISTENING
  TCP w2k_machine:https w2k_machine:0 LISTENING
  TCP w2k_machine:microsoft-ds w2k_machine:0 LISTENING
  TCP w2k_machine:1031 w2k_machine:0 LISTENING
  TCP w2k_machine:1035 w2k_machine:0 LISTENING
  TCP w2k_machine:1037 w2k_machine:0 LISTENING
  TCP w2k_machine:3006 w2k_machine:0 LISTENING
  TCP w2k_machine:3007 w2k_machine:0 LISTENING
  TCP w2k_machine:8080 w2k_machine:0 LISTENING
  TCP w2k_machine:44337 w2k_machine:0 LISTENING
  TCP w2k_machine:1025 w2k_machine:0 LISTENING
  TCP w2k_machine:1025 w2k_machine:3006 ESTABLISHED
  TCP w2k_machine:1025 w2k_machine:3010 TIME_WAIT
  TCP w2k_machine:3005 w2k_machine:0 LISTENING
  TCP w2k_machine:3006 w2k_machine:1025 ESTABLISHED
  TCP w2k_machine:3007 w2k_machine:8080 ESTABLISHED
  TCP w2k_machine:8080 w2k_machine:3007 ESTABLISHED
  TCP w2k_machine:netbios-ssn w2k_machine:0 LISTENING
  TCP w2k_machine:3002 w2k_machine:0 LISTENING
  TCP w2k_machine:3003 w2k_machine:0 LISTENING
  TCP w2k_machine:3004 w2k_machine:0 LISTENING
  TCP w2k_machine:netbios-ssn w2k_machine:0 LISTENING
  TCP w2k_machine:1030 205.206.231.69:http TIME_WAIT
  TCP w2k_machine:8080 XP_machine:3015 TIME_WAIT
  TCP w2k_machine:8080 XP_machine:3016 TIME_WAIT
  TCP w2k_machine:8080 XP_machine:3017 TIME_WAIT
  TCP w2k_machine:8080 XP_machine:3216 TIME_WAIT
  TCP w2k_machine:8080 XP_machine:3217 TIME_WAIT
  TCP w2k_machine:8080 XP_machine:3508 TIME_WAIT
  TCP w2k_machine:8080 XP_machine:4098 ESTABLISHED
  UDP w2k_machine:microsoft-ds *:*
  UDP w2k_machine:3001 *:*
  UDP w2k_machine:3456 *:*
  UDP w2k_machine:44337 *:*
  UDP w2k_machine:domain *:*
  UDP w2k_machine:bootps *:*
  UDP w2k_machine:bootpc *:*
  UDP w2k_machine:netbios-ns *:*
  UDP w2k_machine:netbios-dgm *:*
  UDP w2k_machine:netbios-ns *:*
  UDP w2k_machine:netbios-dgm *:*

How come so many ports are listening?
I'm running ICS on my w2k_machine, and my XP_machine connects through it.
I have a firewall installed.
But whyare all these ports listening?

Can anyone help me out?I've turned off all the services on the machine that
i don't need.
I'm running a webserver, ftpserver, mailserver, webmail and a remote access
program. (ports: 21, 25, 80, 110, 443, 8080 - these should be the only open
ports)
I've disabled netbios on the outgoing NIC, my computer is all up-to-date
(windowsupdate).

Any ideas?

Thans in advance?



Relevant Pages

  • Re: port 3389 Not listening remote desktop connection
    ... It should display what IP addresses and ports your machine is mapping. ... Active Connections ... Is it listening? ... > I think that the repair installation is your best option at this point. ...
    (microsoft.public.windowsxp.work_remotely)
  • Re: Starting iptables
    ... it is not clear that you need a firewall at all. ... just don't open any ports. ... "netstat -putl" will let you find out what listening ports are open. ... mysql is listening on tcp port 3306. ...
    (Debian-User)
  • Re: UPHClean log question
    ... A quick check to see which ports the computer is listening on is to run ... > Windows Firewall saying that the application svchost.exe has been blocked ... > extract from UPHClean might indicating a specific problem that should be ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: UDP Ports, closing Win2K Server (No IIS)
    ... What's listening on UDP 995? ... The worm spreads via email but some antivirus vendors report ... against using IPSec as a firewall, and blocking just one or two ports here ...
    (microsoft.public.inetserver.iis.security)
  • Re: Win2k Netstat sockets interpretation
    ... I have deleted "file and print sharing" under "internet connections and disbled most recognizable "remote access" services under 'services.msc' but ZA detects a few remote access modules running and gives them permission if select "OK" to the suggested query. ... notice randomly ports assigned to urls or ip addresss. ... 'netstat' on Win2K provides a view on the state of the *TDI interface*, ... something appearing as 0.0.0.0 listening means "an outstanding request to ...
    (alt.computer.security)