Sign up ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

TCPView and ZoneAlarm firewall reveal that Firefox is accepting incoming connections on two ports on localhost ( The port numbers are not fixed.

I reinstalled Firefox without any add-ons, and scanned using 3 antivirus programs (Avast, AVG and Norton), but Firefox is still listening to two ports. Other browsers such as Opera, K-Meleon, IE and Safari do not behave like this.

Is something spying on my system?

share|improve this question
I am using Firefox / Opera / K meleon / IE / Safari Only Firefox behaves like this. I tried to temper the data transmitted. And their are some suspicious activites. Even I reinstalled FF without any add-ins (Clearing every thing that belongs to FF/ Registry hacks /Scanned using 3 antivirus Avast / AVG / Nortan's) BUt still the problem remains same. So surely there is a trick. I don't get the point that's why asking. If you know the answer please share. – Hidden Nov 16 '09 at 19:37
I am not asking that firefox is opening port on a perticular site. aka port 80 / 8080 .. I am not opening ports like That is not a issue here. It is opening ports on my system (aka localhost ) Although Their is no fix port. it is used randomly. Kindly note ports traffic is by passed from firewall / router configurations. Guess you are getting my words... – Hidden Nov 16 '09 at 20:05
Maybe on more recent versions of Firefox, there might be more than one loopback connection, resulting in more than 2 entries in netstat. See Why has Firefox opened a bunch of localhost TCP connections? – Arjan Oct 30 '10 at 9:25

2 Answers 2

up vote 9 down vote accepted

These are local loopback ports. Firefox uses them for local communication.

A loopback connection (to IP address can be made by Firefox on non-Unix machines. In this case the browser is communicating with itself as expected, and it is not recommended that this communication be blocked.

Take a look at this: Connections established on startup - Firefox

And the bug report "Connections opened on loopback ( show in NETSTAT and ZoneAlarm has "server rights" alerts" explains:

Whenever Mozilla is running there are two connections to the loopback address that are connected to each other. The ports change but they are usually lower-numbered unregistered ports.

share|improve this answer
This is the answer I am looking for. Do you think Is this a way of getting what users is surfing using Firefox.(another side of coin) – Hidden Nov 16 '09 at 21:17
@Hidden, do you mean you want to eavesdrop on the internal communication of Firefox, or are you afraid someone could do that? (Or is this not about eavesdropping at all?) – Arjan Nov 16 '09 at 21:28
Try to understand my point. Case One : If the browser is sending packets what is being fatched (aka browse) by users right now. their is chances that it could be trapped. I am not asking about data transmitted via servers. This is the browser itself that it advertising. and Hardly its a matter 2-3 days for any FF developer to develop a plugin / tool bar what is being transmitted.and send them using same technology that firefox is using. Case Two : The data collected is being used by some data mining program to gain some business value. Or to spy Remember Nothing is free in this world. – Hidden Nov 16 '09 at 21:41
You can snoop the packets being transmitted by ANY application in windows if you are at the machine and use software like Wireshark ( I think you are being a little too paranoid about this Firefox internal communication. I mean think about it. If someone writes an exploit or installs a plugin on your PC that mines information, I doubt they would do it using this loopback anyway. There are many many ways to spy on what you are doing on a computer. Firefox is a huge open source project with many security experts contributing. They clearly do not consider this an issue. – Marcin Nov 16 '09 at 21:48
In fact, there's sniffer add-ons (a bit like "Wireshark for Firefox") such as HttpFox ( that in theory could mirror all traffic to some untrusted third party. If it did, then people would not install it, but like Marcin explained: such malware doesn't need to eavesdrop on any internal Firefox communications. – Arjan Nov 16 '09 at 22:00

Web browsers will open whatever ports they're told to by whatever content you attempt to access.

share|improve this answer
I'm sorry, but that's wrong. "open a port" means that you accept incoming connections. What you describe is to connect to an open port. – guerda Nov 17 '09 at 7:28

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.