Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am starting to look at my network activity to determine if there's anything on my system communicating with the outside world that shouldn't. How do I determine what is valid and needed?

For example, I had no network activity for a minute, but I still had the following communicating at over 1 KB/sec: svchost.exe (LocalService and NoImpersonation), Address: 239.x.x.x

Others I know are needed, with my router IP.

Edit: For the example I gave, the destination is Location http:// :2869/upnphost/udhisapi.dll?content=uuid:090dfd23-5421-4924-97ab-8968907a1da0 I'm guessing it's Windows Media Player based on what I've seen, though I never ran the 'startup'/installation for it, so it shouldn't have permission to spread information (unless Windows OS license agreement is somehow tied to that).

share|improve this question

One idea is to find out who it is talking to. Goto a whois IP lookup site such as Whois Lookup and enter the 239.x.x.x address, you should then have an idea who the service is communicating to.

share|improve this answer
That didn't really help because is a multicast address. Is there a way to see what addresses the multicast is directed at? or if svchost.exe is supposed to multicast? – BLaZuRE Dec 27 '12 at 7:35
Do you have Windows Live Messenger installed? I found some old pages that refer to Messenger Traffic to the IP and Port you reference, but they are XP Specific.… – BillN Dec 27 '12 at 18:42

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.