Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have Windows 7 and have noticed that my system is using port 4 to connect to a lot of different IP addresses. When it connects to them it is not for very long before it moves to another IP address.

One night I sat and wrote down as many as I could and started checking whois to see where they were and they were from all over the world. I don't understand this.

When I did a search on the net with this question. The only info I could come up with was, that port 4 is used by the US Army and a list of port assignments listed it as "unassigned". If anyone has any clues to what is going on... I would greatly appreciate any info I could get.

share|improve this question
Wireshark can show the actual data that is being transferred. Is this source or destination port 4? TCP or UDP? Either way, it might be a sign of malware, since most newly-written programs avoid using low ports. – grawity Sep 2 '12 at 12:28
What did you use to check? netstat -b should give you an idea what software is using the port – Journeyman Geek Sep 2 '12 at 12:31
TCPView (part of the free Sysinternals Suite) can be very helpful to find out what application is using/listening on which ports. – speakr Sep 2 '12 at 12:48
Port 4 of what protocol? udp, tcp, icmp (type), ipv4 encapsulation (ip protocol 4)? You say "using port 4" - using implies source port, or is it connecting to port 4? If you can post what you are seeing (edit) it will help narrow it down. – Paul Sep 2 '12 at 13:42
Outgoing connections are not made from root ports. – Ben West Oct 6 '12 at 21:03

Conjecture: Malware or botnet is contacting a Command/Control Server.

Other possibilities: Undocumented functionality in windows is engaged in some sort of behavior. You can probably stop outgoing connections to port4 with a firewall, but I suggest you use an external firewall to configure the block.

As in the comments above: You might learn a lot by reading the data using wireshark.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .