Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

TCPView and ZoneAlarm firewall reveal that Firefox is accepting incoming connections on two ports on localhost (127.0.0.1). The port numbers are not fixed.

I reinstalled Firefox without any add-ons, and scanned using 3 antivirus programs (Avast, AVG and Norton), but Firefox is still listening to two ports. Other browsers such as Opera, K-Meleon, IE and Safari do not behave like this.

Is something spying on my system?

share|improve this question
    
I am using Firefox / Opera / K meleon / IE / Safari Only Firefox behaves like this. I tried to temper the data transmitted. And their are some suspicious activites. Even I reinstalled FF without any add-ins (Clearing every thing that belongs to FF/ Registry hacks /Scanned using 3 antivirus Avast / AVG / Nortan's) BUt still the problem remains same. So surely there is a trick. I don't get the point that's why asking. If you know the answer please share. –  Hidden Nov 16 '09 at 19:37
    
I am not asking that firefox is opening port on a perticular site. aka port 80 / 8080 .. I am not opening ports like some_site_name_here.com:80 some_site_name_here.com:8080 That is not a issue here. It is opening ports on my system (aka localhost 127.0.0.1 ) Although Their is no fix port. it is used randomly. Kindly note ports traffic is by passed from firewall / router configurations. Guess you are getting my words... –  Hidden Nov 16 '09 at 20:05
    
Maybe on more recent versions of Firefox, there might be more than one loopback connection, resulting in more than 2 entries in netstat. See Why has Firefox opened a bunch of localhost TCP connections? –  Arjan Oct 30 '10 at 9:25
add comment

2 Answers

up vote 9 down vote accepted

These are local loopback ports. Firefox uses them for local communication.

A loopback connection (to IP address 127.0.0.1) can be made by Firefox on non-Unix machines. In this case the browser is communicating with itself as expected, and it is not recommended that this communication be blocked.

Take a look at this: Connections established on startup - Firefox

And the bug report "Connections opened on loopback (127.0.0.1) show in NETSTAT and ZoneAlarm has "server rights" alerts" explains:

Whenever Mozilla is running there are two connections to the loopback address that are connected to each other. The ports change but they are usually lower-numbered unregistered ports.

share|improve this answer
    
This is the answer I am looking for. Do you think Is this a way of getting what users is surfing using Firefox.(another side of coin) –  Hidden Nov 16 '09 at 21:17
    
@Hidden, do you mean you want to eavesdrop on the internal communication of Firefox, or are you afraid someone could do that? (Or is this not about eavesdropping at all?) –  Arjan Nov 16 '09 at 21:28
    
Try to understand my point. Case One : If the browser is sending packets what is being fatched (aka browse) by users right now. their is chances that it could be trapped. I am not asking about data transmitted via servers. This is the browser itself that it advertising. and Hardly its a matter 2-3 days for any FF developer to develop a plugin / tool bar what is being transmitted.and send them using same technology that firefox is using. Case Two : The data collected is being used by some data mining program to gain some business value. Or to spy Remember Nothing is free in this world. –  Hidden Nov 16 '09 at 21:41
3  
You can snoop the packets being transmitted by ANY application in windows if you are at the machine and use software like Wireshark (wireshark.org). I think you are being a little too paranoid about this Firefox internal communication. I mean think about it. If someone writes an exploit or installs a plugin on your PC that mines information, I doubt they would do it using this loopback anyway. There are many many ways to spy on what you are doing on a computer. Firefox is a huge open source project with many security experts contributing. They clearly do not consider this an issue. –  Marcin Nov 16 '09 at 21:48
    
In fact, there's sniffer add-ons (a bit like "Wireshark for Firefox") such as HttpFox (addons.mozilla.org/en-US/firefox/addon/6647) that in theory could mirror all traffic to some untrusted third party. If it did, then people would not install it, but like Marcin explained: such malware doesn't need to eavesdrop on any internal Firefox communications. –  Arjan Nov 16 '09 at 22:00
show 2 more comments

Web browsers will open whatever ports they're told to by whatever content you attempt to access.

share|improve this answer
2  
I'm sorry, but that's wrong. "open a port" means that you accept incoming connections. What you describe is to connect to an open port. –  guerda Nov 17 '09 at 7:28
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.