Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Was trying to debug a Samba sharing issue with Mac OS X so I turned on logging for my Windows Firewall. I didn't expect a lot of conections but the thing filled up quickly. Here's a sample:

2009-12-21 08:49:32 OPEN-INBOUND TCP 192.168.0.4 192.168.0.3 56335 139 - - - - - - - - -
2009-12-21 08:49:33 OPEN-INBOUND TCP 192.168.0.4 192.168.0.3 56337 139 - - - - - - - - -
2009-12-21 08:50:02 OPEN UDP 192.168.0.3 68.87.73.242 1389 53 - - - - - - - - -
2009-12-21 08:50:02 CLOSE TCP 192.168.0.3 212.96.161.238 1391 80 - - - - - - - - -
2009-12-21 08:50:02 OPEN UDP 192.168.0.3 68.87.71.226 60290 53 - - - - - - - - -
2009-12-21 08:50:02 OPEN TCP 192.168.0.3 212.96.161.238 1391 80 - - - - - - - - -
2009-12-21 08:50:02 OPEN TCP 192.168.0.3 212.96.161.238 1393 80 - - - - - - - - -
2009-12-21 08:50:04 CLOSE TCP 192.168.0.3 212.96.161.238 1393 80 - - - - - - - - -
2009-12-21 08:50:41 CLOSE UDP 192.168.0.3 192.168.0.4 137 50300 - - - - - - - - -

I can pick out the local IP addresses (192.168.0.3 is my Windows XP machine, 192.169.0.4 is Mac OS X) as I debug the Samba issue. But some of the others resolve to Comcast (my ISP) and others resolve to weird hosts like van-dns.com and navisite.net. It doesn't look like any connection sent/received any bytes. I used the reference here: http://technet.microsoft.com/en-us/library/cc758040%28WS.10%29.aspx.

Is it a cause for concern?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

From the log you have shown, it looks like standard port 80 outbound connections to 212.96.161.238. I don't see any problem there, as it looks like its from your machine, here is a whois: http://www.ip-adress.com/whois/212.96.161.238 looks like AVG updates? http://www.robtex.com/dns/update.avg.com.html (notice the ip in the list)

I don't see any concerns there, unless you have more logs showing something else, I wouldn't worry about it, standard TCP traffic.

share|improve this answer
    
Thanks. I guess it was just the sheer volume that got me thinking. –  gmoore Dec 21 '09 at 15:39
    
@gmoore, you're new to SU, but if this is the answer, click the checkbox :P and a vote up wouldn't hurt either.. thanks! :) –  Jakub Dec 21 '09 at 16:11
    
I hear you, just seeing if anyone else chimes in :) –  gmoore Dec 21 '09 at 16:32

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.