Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have Windows 7 and have noticed that my system is using port 4 to connect to a lot of different IP addresses. When it connects to them it is not for very long before it moves to another IP address.

One night I sat and wrote down as many as I could and started checking whois to see where they were and they were from all over the world. I don't understand this.

When I did a search on the net with this question. The only info I could come up with was, that port 4 is used by the US Army and a list of port assignments listed it as "unassigned". If anyone has any clues to what is going on... I would greatly appreciate any info I could get.

share|improve this question
    
Wireshark can show the actual data that is being transferred. Is this source or destination port 4? TCP or UDP? Either way, it might be a sign of malware, since most newly-written programs avoid using low ports. –  grawity Sep 2 '12 at 12:28
    
What did you use to check? netstat -b should give you an idea what software is using the port –  Journeyman Geek Sep 2 '12 at 12:31
1  
TCPView (part of the free Sysinternals Suite) can be very helpful to find out what application is using/listening on which ports. –  speakr Sep 2 '12 at 12:48
2  
Port 4 of what protocol? udp, tcp, icmp (type), ipv4 encapsulation (ip protocol 4)? You say "using port 4" - using implies source port, or is it connecting to port 4? If you can post what you are seeing (edit) it will help narrow it down. –  Paul Sep 2 '12 at 13:42
    
Outgoing connections are not made from root ports. –  Ben West Oct 6 '12 at 21:03
add comment

1 Answer

Conjecture: Malware or botnet is contacting a Command/Control Server.

Other possibilities: Undocumented functionality in windows is engaged in some sort of behavior. You can probably stop outgoing connections to port4 with a firewall, but I suggest you use an external firewall to configure the block.

As in the comments above: You might learn a lot by reading the data using wireshark.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.