Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am starting to look at my network activity to determine if there's anything on my system communicating with the outside world that shouldn't. How do I determine what is valid and needed?

For example, I had no network activity for a minute, but I still had the following communicating at over 1 KB/sec: svchost.exe (LocalService and NoImpersonation), Address: 239.x.x.x

Others I know are needed, with my router IP.

Edit: For the example I gave, the destination is 239.255.255.250:1900 Location http:// 192.168.1.2 :2869/upnphost/udhisapi.dll?content=uuid:090dfd23-5421-4924-97ab-8968907a1da0 I'm guessing it's Windows Media Player based on what I've seen, though I never ran the 'startup'/installation for it, so it shouldn't have permission to spread information (unless Windows OS license agreement is somehow tied to that).

share|improve this question

1 Answer 1

One idea is to find out who it is talking to. Goto a whois IP lookup site such as Whois Lookup and enter the 239.x.x.x address, you should then have an idea who the service is communicating to.

share|improve this answer
    
That didn't really help because 239.255.255.250 is a multicast address. Is there a way to see what addresses the multicast is directed at? or if svchost.exe is supposed to multicast? –  BLaZuRE Dec 27 '12 at 7:35
    
Do you have Windows Live Messenger installed? I found some old pages that refer to Messenger Traffic to the IP and Port you reference, but they are XP Specific. windowsnetworking.com/kbase/WindowsTips/WindowsXP/RegistryTips/… –  BillN Dec 27 '12 at 18:42

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.