Re: how do you display incoming and outgoing connections in windows?

jameshanley39_at_yahoo.co.uk
Date: 09/21/05 

Date: 20 Sep 2005 15:29:33 -0700

Volker Birk wrote:
> jameshanley39@yahoo.co.uk wrote:
> > > http://www.sysinternals.com/Utilities/TcpView.html
> > turns out not to be a bug in netstat. results are the same in TCPView,
> > Active Ports, and netstat. But I just noticed, when making an outgoing
> > connection looking at the 2 entries. The process is different.
> > telnet www.google.com 80
> > process inetinfo.exe listens 0.0.0.0:80
> > process telnet.exe established 192.168.0.2:1398, 66.102..:80
>
> Hm... what happens if you telnet your own box on port 80? Are you
> getting a connection?

yes, I get a prompt.
When I do telnet 127.0.0.1 80 <-- prompt
When I do telnet 0.0.0.0 80 <-- no prompt.

infact, as soon as i've booted into windows, regardless whether i've
opened my browser, I have the following processes running on the
following ports.
                          local port - listening
inetinfo.exe 0.0.0.0 25,80,443,1025,3456
svchost.exe 0.0.0.0 135,1037,3544
svchost.exe 192.168.0.2 520,1033
tcpsvcs.exe 0.0.0.0 7,9,13,17,19,7,13,17,19
system 192.168.0.2 138,137,139
system 0.0.0.0 445,445 (yep, twice, same process/PID !)

[i/james wrote]
> > I imagine that with an incoming connection, it'd still be 2 entries,
> > but the process may the the same. e.g. ftpserver.exe listening, and
> > ftpserver.exe established.
>

as can be seen in my follow up post, i was guessing wrongly. On an
incoming ftp connection. I found that when I ran server and a connetion
was established, nothing was listed as listening. This was because
nothing was listening before and those processes are nothing to do with
it! 

--
All of those listening processes are independent of my outgoing and
incoming conections. They are just there when windows loads up.  Thus,
they won't tell me whether or not i'm making an incoming or outgoing
connection.  Whether or not a connection is incoming or outgoing is
nothing to do with whether one of those built in windows procesesis
listening on a port. So, nothing to do with the number of entries.

Relevant Pages

  • Re: Active Ports
    ... > have 35 services listening on different ports and one established ... Well is Messenger supposed to have a connection? ... You may want to use Process Explorer to look at running processes ...
    (comp.security.firewalls)
  • RE: Weird Incoming IPs and port numbers.
    ... Weird Incoming IP's and port numbers. ... This splits the connection to 3 computers in the house. ... The first two sets of ports are unassigned. ... picture of what type of traffic is on your internal network and will allow ...
    (Incidents)
  • Re: tool to discover some non-firewalled TCP ports?
    ... > application must listen on ports accessible to the internet. ... (including those that do outgoing filtering any proxy filtering). ... distributed DNS and hold the TCP connection open so it ... would have to be listening all the time on each of the ports you want to ...
    (comp.os.linux.networking)
  • Re: Receive Connector - [WP]
    ... You can use any that you are bound to the connection for other purposes. ... You probably ought to stay away from any you might bind in the future. ... are there any recommended ports for this kind of scenario ...or best ... If you want to use the same IP, change the port it is listening on. ...
    (microsoft.public.exchange.setup)
  • Re: Port Scans
    ... for tcp 'listening' means it is waiting for a connection on that port. ... the *:* is for udp ports that are listening, ... >>this group for other questions about ports. ...
    (microsoft.public.security)