Couple of strange entries in netstat

Discussion in 'Computer Security' started by Donald Jacobsen, Sep 20, 2003.

  1. Hello all,

    Started seeing some weird disk activity on my computer, so I decided to
    check my system out, looking for backdoors, etc. Antivirus and Adaware
    didn't pick up anything, but when I ran netstat, I got this:

    Active Connections

    Proto Local Address Foreign Address State
    (snipped)
    TCP balrog:2416 localhost:43958 ESTABLISHED
    TCP balrog:43958 localhost:2416 ESTABLISHED

    No clue what these port numbers are. Why would my system be connecting to
    itself on these 2 ports?

    Thanks,
    --Donald
    Donald Jacobsen, Sep 20, 2003
    #1
    1. Advertising

  2. Donald Jacobsen

    Chuck Guest

    On Sat, 20 Sep 2003 13:15:13 GMT, "Donald Jacobsen"
    <> wrote:

    >Hello all,
    >
    > Started seeing some weird disk activity on my computer, so I decided to
    >check my system out, looking for backdoors, etc. Antivirus and Adaware
    >didn't pick up anything, but when I ran netstat, I got this:
    >
    >Active Connections
    >
    > Proto Local Address Foreign Address State
    > (snipped)
    > TCP balrog:2416 localhost:43958 ESTABLISHED
    > TCP balrog:43958 localhost:2416 ESTABLISHED
    >
    >No clue what these port numbers are. Why would my system be connecting to
    >itself on these 2 ports?
    >
    >Thanks,
    >--Donald
    >


    You need to know what process has attached those ports. A good, free
    port mapper is Active Ports.
    http://www.ntutility.com/freeware.html

    Much more useful than netstat.

    Cheers,

    Chuck


    Chuck

    Spam sucks - PLEASE get rid of the spam before emailing me!
    Chuck, Sep 20, 2003
    #2
    1. Advertising

  3. In article <BpYab.529$>,
    says...
    > Hello all,
    >
    > Started seeing some weird disk activity on my computer, so I decided to
    > check my system out, looking for backdoors, etc. Antivirus and Adaware
    > didn't pick up anything, but when I ran netstat, I got this:
    >
    > Active Connections
    >
    > Proto Local Address Foreign Address State
    > (snipped)
    > TCP balrog:2416 localhost:43958 ESTABLISHED
    > TCP balrog:43958 localhost:2416 ESTABLISHED
    >
    > No clue what these port numbers are. Why would my system be connecting to
    > itself on these 2 ports?
    >


    Some personal firewalls do this. You can see what runs on what ports
    with a number of utilities, one is fport from foundstone.com, but these
    days almost everyone offers a util to do this.

    /steve
    --
    No one gives you more control of your e-mail than we do!
    http://www.cotse.net/servicedetails.html
    E-Mail, Anon Proxies, Remailers, Usenet, Web Hosting, More.
    The Internet's Full Service Privacy Website, Your Shield From The
    Internet.
    Stephen K. Gielda, Sep 22, 2003
    #3
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. =?Utf-8?B?V2FsbHk=?=

    Netstat command

    =?Utf-8?B?V2FsbHk=?=, Mar 25, 2005, in forum: Wireless Networking
    Replies:
    1
    Views:
    723
  2. tokyosky

    netstat question

    tokyosky, Dec 28, 2005, in forum: Firefox
    Replies:
    13
    Views:
    3,717
    Adrian
    Dec 29, 2005
  3. John Ramsden
    Replies:
    0
    Views:
    825
    John Ramsden
    Jul 24, 2004
  4. TheKeith
    Replies:
    4
    Views:
    482
    TheKeith
    Jul 31, 2004
  5. Rusty

    Strange entries in address book

    Rusty, Jun 13, 2005, in forum: Computer Security
    Replies:
    8
    Views:
    466
    BillieBaby
    Jun 13, 2005
Loading...

Share This Page