Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Recently I got a new laptop with Windows 7. I have a Linux Ubuntu gateway where I block pretty much everything except exactly what I want public like Apache and forwarding of the Windows 7 packets.

All works well, but all day long I get connection requests from Windows 7 to my gateway. Those are refused so I don't foresee any security issues, but I'm wondering why would W7 do that?!

Sample setup:

Gateway is 192.168.1.1 and 192.168.2.1 (2 NICs for added security, Internal & External gateways) Windows 7 is 192.168.2.7

I get messages such as:

SRC=192.168.2.7 DST=192.168.2.1 LEN=48 TOS=0x00 PREC=0x00 TTL=128 ID=5778 DF PROTO=TCP SPT=51955 DPT=80 WINDOW=8192 RES=0x00 SYN URGP=0

Anyone knows what that's about?

Thank you. Alexis

share|improve this question
1  
See this blog post for more information: blog.superuser.com/2011/05/16/windows-7-network-awareness –  KronoS May 28 '11 at 0:45

2 Answers 2

Running a proper netstat command in Windows 7 will show all connections, protocols and ports and associated programs when possible.

Netstat /?

Microsoft Windows [Version 6.1.7600]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Windows\system32>netstat /?

Displays protocol statistics and current TCP/IP network connections.

NETSTAT [-a] [-b] [-e] [-f] [-n] [-o] [-p proto] [-r] [-s] [-t] [interval]

  -a            Displays all connections and listening ports.

  -b            Displays the executable involved in creating each connection or
                listening port. In some cases well-known executables host
                multiple independent components, and in these cases the
                sequence of components involved in creating the connection
                or listening port is displayed. In this case the executable
                name is in [] at the bottom, on top is the component it called,
                and so forth until TCP/IP was reached. Note that this option
                can be time-consuming and will fail unless you have sufficient
                permissions.

  -e            Displays Ethernet statistics. This may be combined with the -s
                option.

  -f            Displays Fully Qualified Domain Names (FQDN) for foreign
                addresses.

  -n            Displays addresses and port numbers in numerical form.

  -o            Displays the owning process ID associated with each connection.

  -p proto      Shows connections for the protocol specified by proto; proto
                may be any of: TCP, UDP, TCPv6, or UDPv6.  If used with the -s
                option to display per-protocol statistics, proto may be any of:
                IP, IPv6, ICMP, ICMPv6, TCP, TCPv6, UDP, or UDPv6.

  -r            Displays the routing table.

  -s            Displays per-protocol statistics.  By default, statistics are
                shown for IP, IPv6, ICMP, ICMPv6, TCP, TCPv6, UDP, and UDPv6;
                the -p option may be used to specify a subset of the default.
  -t            Displays the current connection offload state.

  interval      Redisplays selected statistics, pausing interval seconds
                between each display.  Press CTRL+C to stop redisplaying
                statistics.  If omitted, netstat will print the current
                configuration information once.
share|improve this answer
    
Since the connection is refused on a local network, I would imagine that if I can see it with netstat, it will be close to instantaneously gone... Don't you think? I tried a bit and I just cannot see that one in particular. Plus, the list is way more than one screen in height... –  Alexis Wilke Jun 9 '11 at 4:11

Most likely it is Windows detecting whether or not you are connected to the internet. alt text

Otherwise, it could be pretty much anything on your laptop that was pre loaded by the manufacturer. Most likely a product update type checker.

As long as you got your copy of Windows from a genuine supplier, you can be sure that it will not be malicious.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.