Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Was trying to debug a Samba sharing issue with Mac OS X so I turned on logging for my Windows Firewall. I didn't expect a lot of conections but the thing filled up quickly. Here's a sample:

2009-12-21 08:49:32 OPEN-INBOUND TCP 192.168.0.4 192.168.0.3 56335 139 - - - - - - - - -
2009-12-21 08:49:33 OPEN-INBOUND TCP 192.168.0.4 192.168.0.3 56337 139 - - - - - - - - -
2009-12-21 08:50:02 OPEN UDP 192.168.0.3 68.87.73.242 1389 53 - - - - - - - - -
2009-12-21 08:50:02 CLOSE TCP 192.168.0.3 212.96.161.238 1391 80 - - - - - - - - -
2009-12-21 08:50:02 OPEN UDP 192.168.0.3 68.87.71.226 60290 53 - - - - - - - - -
2009-12-21 08:50:02 OPEN TCP 192.168.0.3 212.96.161.238 1391 80 - - - - - - - - -
2009-12-21 08:50:02 OPEN TCP 192.168.0.3 212.96.161.238 1393 80 - - - - - - - - -
2009-12-21 08:50:04 CLOSE TCP 192.168.0.3 212.96.161.238 1393 80 - - - - - - - - -
2009-12-21 08:50:41 CLOSE UDP 192.168.0.3 192.168.0.4 137 50300 - - - - - - - - -

I can pick out the local IP addresses (192.168.0.3 is my Windows XP machine, 192.169.0.4 is Mac OS X) as I debug the Samba issue. But some of the others resolve to Comcast (my ISP) and others resolve to weird hosts like van-dns.com and navisite.net. It doesn't look like any connection sent/received any bytes. I used the reference here: http://technet.microsoft.com/en-us/library/cc758040%28WS.10%29.aspx.

Is it a cause for concern?

share|improve this question
up vote 1 down vote accepted

From the log you have shown, it looks like standard port 80 outbound connections to 212.96.161.238. I don't see any problem there, as it looks like its from your machine, here is a whois: http://www.ip-adress.com/whois/212.96.161.238 looks like AVG updates? http://www.robtex.com/dns/update.avg.com.html (notice the ip in the list)

I don't see any concerns there, unless you have more logs showing something else, I wouldn't worry about it, standard TCP traffic.

share|improve this answer
    
Thanks. I guess it was just the sheer volume that got me thinking. – gmoore Dec 21 '09 at 15:39
    
@gmoore, you're new to SU, but if this is the answer, click the checkbox :P and a vote up wouldn't hurt either.. thanks! :) – Jakub Dec 21 '09 at 16:11
    
I hear you, just seeing if anyone else chimes in :) – gmoore Dec 21 '09 at 16:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .