Re: how do you display incoming and outgoing connections in windows?
Date: 20 Sep 2005 15:29:33 -0700
Volker Birk wrote:
> email@example.com wrote:
> > > http://www.sysinternals.com/Utilities/TcpView.html
> > turns out not to be a bug in netstat. results are the same in TCPView,
> > Active Ports, and netstat. But I just noticed, when making an outgoing
> > connection looking at the 2 entries. The process is different.
> > telnet www.google.com 80
> > process inetinfo.exe listens 0.0.0.0:80
> > process telnet.exe established 192.168.0.2:1398, 66.102..:80
> Hm... what happens if you telnet your own box on port 80? Are you
> getting a connection?
yes, I get a prompt.
When I do telnet 127.0.0.1 80 <-- prompt
When I do telnet 0.0.0.0 80 <-- no prompt.
infact, as soon as i've booted into windows, regardless whether i've
opened my browser, I have the following processes running on the
local port - listening
inetinfo.exe 0.0.0.0 25,80,443,1025,3456
svchost.exe 0.0.0.0 135,1037,3544
svchost.exe 192.168.0.2 520,1033
tcpsvcs.exe 0.0.0.0 7,9,13,17,19,7,13,17,19
system 192.168.0.2 138,137,139
system 0.0.0.0 445,445 (yep, twice, same process/PID !)
> > I imagine that with an incoming connection, it'd still be 2 entries,
> > but the process may the the same. e.g. ftpserver.exe listening, and
> > ftpserver.exe established.
as can be seen in my follow up post, i was guessing wrongly. On an
incoming ftp connection. I found that when I ran server and a connetion
was established, nothing was listed as listening. This was because
nothing was listening before and those processes are nothing to do with
-- All of those listening processes are independent of my outgoing and incoming conections. They are just there when windows loads up. Thus, they won't tell me whether or not i'm making an incoming or outgoing connection. Whether or not a connection is incoming or outgoing is nothing to do with whether one of those built in windows procesesis listening on a port. So, nothing to do with the number of entries.