Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I just install the TCPview to check if there are any abnormalities in my computer connections, and there are something looks strange:

There are 2-3 process that show the following status from time to time:

Process name: [system process]

Remote address: some IP address that do NOT belong to any company/insistutes/web site (confirmed by several internet IP locators)

Process state: TIMEWAIT

Is this OK or there are something abnormal in my computer connections? I run trojan cleans from time to time, no trojans or virus found so far, and I have windows 7's standard firewall installed and several well-known and third-party anti-virus/anti-trojan software running, and my adiminstor's password is very long, so althrough it is not safe from being hacked but the computer is not the easiest target either.

share|improve this question

1 Answer 1

Short answer: there is probably nothing to worry about.

Those are connections that used to be associated with a different process.

The process is gone, now the connection shows System Process because the original process can't be associated with it.

In and of itself, this isn't evidence of anything untoward.

If the IP addresses in question are in a Private IP range, then they're 'fake' IPs your network administrator uses for your local network and are no cause for alarm. Those would be the following 3 ranges:

  • 10.0.0.0 - 10.255.255.255

  • 172.16.0.0 - 172.31.255.255

  • 92.168.0.0 - 192.168.255.255

Even if the IP addresses are not elements of the ranges posted above, there are any number of possible explanations that don't imply anything untoward or improper.

If you wish to continue prosecuting this issue due to some cause for concern you have not outlined above, the next step might be to install and learn to use a packet analyzer like Wireshark.

share|improve this answer
    
Hi, thanks for this reply, the IP address shown is from a different ISP provider, not my own ISP, the address is not anything like you listed here, can you tell me if this looks suspicous? btw, I have installed Wireshark, learn to use it when I am back home. –  user0002128 Feb 21 '13 at 3:12
    
You haven't told us anything that is a real cause for concern. In the "Remote address" column in TCPView, what is the port listed after the : in the machine name? If it's 80 then your web browser could have just been pulling data from it. A page you were at, probably with a properly-resolving IP, could have linked to a server without a properly-resolving IP. If you like learning about computers and networking, I'd play with Wireshark and figure out the score. Otherwise, I'd completely forget the whole thing. –  John in Ohio Feb 21 '13 at 3:21

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.