Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

TCPView and ZoneAlarm firewall reveal that Firefox is accepting incoming connections on two ports on localhost ( The port numbers are not fixed.

I reinstalled Firefox without any add-ons, and scanned using 3 antivirus programs (Avast, AVG and Norton), but Firefox is still listening to two ports. Other browsers such as Opera, K-Meleon, IE and Safari do not behave like this.

Is something spying on my system?

share|improve this question
I am using Firefox / Opera / K meleon / IE / Safari Only Firefox behaves like this. I tried to temper the data transmitted. And their are some suspicious activites. Even I reinstalled FF without any add-ins (Clearing every thing that belongs to FF/ Registry hacks /Scanned using 3 antivirus Avast / AVG / Nortan's) BUt still the problem remains same. So surely there is a trick. I don't get the point that's why asking. If you know the answer please share. – Hidden Nov 16 '09 at 19:37
I am not asking that firefox is opening port on a perticular site. aka port 80 / 8080 .. I am not opening ports like That is not a issue here. It is opening ports on my system (aka localhost ) Although Their is no fix port. it is used randomly. Kindly note ports traffic is by passed from firewall / router configurations. Guess you are getting my words... – Hidden Nov 16 '09 at 20:05
Maybe on more recent versions of Firefox, there might be more than one loopback connection, resulting in more than 2 entries in netstat. See Why has Firefox opened a bunch of localhost TCP connections? – Arjan Oct 30 '10 at 9:25
up vote 9 down vote accepted

These are local loopback ports. Firefox uses them for local communication.

A loopback connection (to IP address can be made by Firefox on non-Unix machines. In this case the browser is communicating with itself as expected, and it is not recommended that this communication be blocked.

Take a look at this: Connections established on startup - Firefox

And the bug report "Connections opened on loopback ( show in NETSTAT and ZoneAlarm has "server rights" alerts" explains:

Whenever Mozilla is running there are two connections to the loopback address that are connected to each other. The ports change but they are usually lower-numbered unregistered ports.

share|improve this answer
This is the answer I am looking for. Do you think Is this a way of getting what users is surfing using Firefox.(another side of coin) – Hidden Nov 16 '09 at 21:17
@Hidden, do you mean you want to eavesdrop on the internal communication of Firefox, or are you afraid someone could do that? (Or is this not about eavesdropping at all?) – Arjan Nov 16 '09 at 21:28
Try to understand my point. Case One : If the browser is sending packets what is being fatched (aka browse) by users right now. their is chances that it could be trapped. I am not asking about data transmitted via servers. This is the browser itself that it advertising. and Hardly its a matter 2-3 days for any FF developer to develop a plugin / tool bar what is being transmitted.and send them using same technology that firefox is using. Case Two : The data collected is being used by some data mining program to gain some business value. Or to spy Remember Nothing is free in this world. – Hidden Nov 16 '09 at 21:41
You can snoop the packets being transmitted by ANY application in windows if you are at the machine and use software like Wireshark ( I think you are being a little too paranoid about this Firefox internal communication. I mean think about it. If someone writes an exploit or installs a plugin on your PC that mines information, I doubt they would do it using this loopback anyway. There are many many ways to spy on what you are doing on a computer. Firefox is a huge open source project with many security experts contributing. They clearly do not consider this an issue. – Marcin Nov 16 '09 at 21:48
In fact, there's sniffer add-ons (a bit like "Wireshark for Firefox") such as HttpFox ( that in theory could mirror all traffic to some untrusted third party. If it did, then people would not install it, but like Marcin explained: such malware doesn't need to eavesdrop on any internal Firefox communications. – Arjan Nov 16 '09 at 22:00

Web browsers will open whatever ports they're told to by whatever content you attempt to access.

share|improve this answer
I'm sorry, but that's wrong. "open a port" means that you accept incoming connections. What you describe is to connect to an open port. – guerda Nov 17 '09 at 7:28

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.