Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have many questions. However, to begin in the easiest and shortest manner. I am trying to figure out why when I type cmd prompt netstat -a I get a plethora of IP addresses and links that I am almost certain are not right or correct.

Or maybe my IT/computer networking hubby snooping. I have absolutely nothing to hide and can't figure out why he would be concerned. With his level of network security training a "leak" in my home wireless net, makes no sense.

So, I want to find out if he is indeed snooping. What should I look for to be considered; harmful? Is UDP necessary?

Below are a few:

TCP    my ip address here:49372    server-205-251-203-249:80  ESTABLISHED
TCP   my ip:49388    star-01-02-lax1:80     ESTABLISHED
 TCP    :49443    r-199-59-148-16:443    TIME_WAIT
 TCP    :49448    209-18-46-66:80        ESTABLISHED
 TCP    :49449    a96-7-48-51:80         ESTABLISHED
 TCP    :49450    65.55.25.44:80         ESTABLISHED
 TCP    :49451    a96-7-48-64:80         ESTABLISHED
 TCP    :49454    65.55.184.15:443       ESTABLISHED
 TCP    :49455    TheTank:445            SYN_SENT
 TCP    :49456    TheTank:445            SYN_SENT
 TCP    :49457    TheTank:445            SYN_SENT
 TCP    :49458    TheTank:139            SYN_SENT
 TCP    :49459    android_f2f09956193035b1:9100  SYN_SENT
 TCP    :49460    dfw06s17-in-f7:443     ESTABLISHED

Funny thing is he just bought an Android phone last week (prior we had iPhones) and suddenly I see the above ANDROID_F… in the command output.

share|improve this question
5  
I don't see why this should matter... if you have nothing to hide it shouldn't really matter. Also, if he is snooping, wouldn't he have seen this post? –  ekaj Mar 13 '13 at 4:02
    
Your axiom is false: falkvinge.net/2012/07/19/… –  Everett Sep 9 at 15:48

2 Answers 2

up vote 1 down vote accepted

The problem with how you're using netstat is, you're missing out on the really digestable information

try netstat -ba - this will give you the name of the binary of programme using the port and hostname and a will give you all the ports being used. If you want IP addresses use netstat -ban

I note that computers are chatty little things. They're constantly telling each other "I'm here" "This is my IP address BACK OFF!" and even talking to themselves (really!). Unless you KNOW exactly what you're looking for, there's just too much noise.

share|improve this answer
    
LOL, gotcha. Maybe, I should find a less advanced forum? I tried netstat -ba. But, like you said, if I don't know what I am looking for ... Being that I especially am unclear on what truly is "good" or "bad." All I can do is post what came up when I entered the command? I feel a bit more like a noob again. Just when I think I have a decent grasp on networking. I get lost in translation. Literally. :/ –  WIFI WIFE WONDERS Mar 13 '13 at 7:51
    
I quite honestly think the real issue is trust here, but we're a tech Q&A site not a relationship Councillor. I don't see anything suspicious in what you posted, and does look like normal traffic to me. If you're really worried about snooping, talk to the husband, get the key for installation (if its a laptop, it should be under the system or battery), reinstall things yourself from known good media, and don't let anyone access anything but a limited account unless necessary, yourself included. This will also improve your computer skills ;) –  Journeyman Geek Mar 13 '13 at 8:40
    
LOL, no need for a counselor here. Just a better understanding on crap I try to understand! One other issue, is just that my user accounts. I am unable to log into my others. But, the one I am on. Just says user profile failed to load* Which is why I haven't done a restore, don't wanna loose anything on those other profiles until I am sure I am able to fully access them. (I have snooped into my own files with no business doing so ;)) Thanks again for taking a moment to look it over. I know talking to stubborn people isn't the best way to spend time. –  WIFI WIFE WONDERS Mar 13 '13 at 8:55

you're looking at everything that your network port sees. there is a lot more going on at the networking level than you expect.

the presence of "android_" simply means the iphone is on the network, or has been plugged in with the tether option.

And, my philosophy while on the computer is to act like someone is always watching. This way you don't get into any trouble (or cover your tracks extra well).

share|improve this answer
    
Thanks Snake. I know it's like looking at a menu in a foreign language. I kind of get it, but can't tell ya specifically. if that makes sense? I am not worried about what is seen. I am more concerned why anyone would put so much effort un necessarily. So, to clarify seeing the "android" on there can simply mean it is on the home network. I am not sure I clarified, but this is my personal laptop. No one is supposed to be on here but myself. And all my other user profiles mysteriously just stopped working. So I can no longer log into my other ones. Including my guests. –  WIFI WIFE WONDERS Mar 13 '13 at 6:46
    
I'd ask why you feel so certain someone is "snooping" on your pc? There are a lot of other explanations that might be probable, such as viruses which will cause weird behavior. And a heads up, most good antivirus software will catch keyloggers or even remote screen view software (such as vnc), so get a good AV and run it. I recommend MalwareBytes and SuperAntispyware. Both have free versions but don't provide realtime protection (they are only scanners). Give them a go, check the back of the machine for hardware keyloggers (usually USB stick or plugged in between the mouse/keyboard and pc). –  SnakeDoc Mar 13 '13 at 6:54
    
Well, to keep it short. My spouse was on his pc helping me with a resume. I noticed some user profiles with my name. I asked what they were. he seemed kinda hesitant to answer. He lets other people on his pc and I have had a REALLY horrible experience w/someone getting into my old pc. I asked if he could just delete them. Since he said it was just because he hadn't deleted it from an old hard drive switch. No biggie,right? it's was just supposed to be old files nothing important. But, he refuses to delete them. When he saved, it auto opened my profile and I saw a TON of files mostly in code. –  WIFI WIFE WONDERS Mar 13 '13 at 7:03
    
Leaving behind bits of old profiles is normal for windows. You're reading too much into it, IMO. Most comouter folk are packrats. I have a handful of hard drives from obsolete old officice systems 'in case'. –  Journeyman Geek Mar 13 '13 at 7:04
    
@JourneymanGeek was just about to say the same lol. I have a lot of old data everywhere, from multiple hard drives in my desk to 1TB drive in my pc filled with old data. I'd say it's abnormal for an IT guy to permanently delete data. It's likely just old data and nothing to worry about. If he was hiding the data, it wouldn't be accessible (hidden volume, external drive, ADS, etc). I wouldn't worry... –  SnakeDoc Mar 13 '13 at 7:09

protected by nhinkle Sep 9 at 18:50

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.