Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am running Windows 7 64-bit.

I can see which network connections are established by running netstat -anb. This tells me that there are a lot of connections established by "System".

Is there any way to drill down into this any more to determine why these connections exist?

share|improve this question

migrated from Nov 27 '12 at 22:37

This question came from our site for professional and enthusiast programmers.

up vote 1 down vote accepted

"System" is the Windows kernel, in some respect or another. From userspace, the Windows kernel is basically opaque, and you can't examine the behavior of its subsystems or drivers. It could be:

  • A device driver, such as a VPN or netfilt driver
  • Malware/virus/rootkit
  • Some kind of packet capturing software that has a kernel driver
  • Some system service that is moved into the kernel, maybe DRM for video playback

Depending on which remote hosts are being connected to, you should be able to determine if it's malicious or not. If it's just connecting to localhost or a local subnet (such as 127.x, 10.x or 192.x) I wouldn't worry about it. If it's connecting to remote hosts on the public Internet that you aren't familiar with, especially if they have domain names or a reverse DNS entry pointing at a domain name, you might worry, depending on what those domains are.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.