6

This seems a bit odd. Using netstat -a -b -n I've found the following:

TCP 192.168.1.X:1150   157.56.124.76:443 ESTABLISHED [Explorer.EXE]

It turns out that the ip 157.56.124.76 which resolves to db3wns2011017.wns.windows.com is a static ip from Microsoft.

Moreover, using tcpView from sysinternals I can see that it's a TCP connection over https.

I tried closing the connection and after a second it was back on. Initially a kb of data was sent and nothing after that..

What is this all about and why is it Established?

I have windows 8.1 enterprise. I don't have OneDrive or any other microsoft cloud stuff installed. This is persistent, and is there after booting.

update

After finding out that this is related to Windows Push Notifications, I followed the steps here to disable such notifications, but the connection remains.

Improve this question
2
  • social.technet.microsoft.com/Forums/windows/en-US/… the final comment there might be helpful. If you disable onedrive in metro, but not by GP, it still pings the server apparently. WNS is not just for microsoft products, so just disabling the microsoft products would be insufficient.
    – Tritium21
    Jan 26, 2015 at 19:05
  • Already tried that. Didn't help. I'll start uninstalling metro apps. Thanks
    – Odys
    Jan 26, 2015 at 19:25

2 Answers 2

Reset to default
3

Windows connects to MS servers for many purposes, like syncing time, checking for updates, and even tiny things like displaying whether your PC has access to the internet when you mouse over the notification icon for the network (windows downloads a file from one of their servers to test connectivity).

As for why its established, that is related to how the TCP protocol works. a client wants to create a connection between an open port on the client, and a listening port on the server. once this process is complete, the connection between the two points is "Established". Often server processes fork, or remap their local ports, so that after you connect to the listening port, an connection is established between a dynamically choosen server port, and the client port.

Improve this answer
1
  • + device icons!
    – Keltari
    Jan 26, 2015 at 19:46
0

It is the Network Connection Broker service (NcbService) that keeps calling out. Its function is to 'allow Windows Store Apps to receive notifications from the internet'.

Hit 'Win+R' > enter 'services.msc' > locate 'Network Connection Broker' in the list > stop and disable the service and you are good to go!

Improve this answer
5
  • 1
    Wouldn't disabling that service also have a negative effect on "legitimate" network traffic?
    – Burgi
    Apr 27, 2016 at 14:51
  • Such as? I have not noticed any drawbacks
    – snubbelbuff
    May 2, 2016 at 13:13
  • 1
    I don't know, that's why I asked.
    – Burgi
    May 2, 2016 at 13:20
  • You'd clearly "[dis]allow Windows Store Apps to receive notifications from the internet". That sounds like a significant negative effect, assuming you're using any of these.
    – Mario
    May 23, 2016 at 7:03
  • The questioner states that at least one unsuccessful attempt at closing the connection has been made and that he/she wishes to close the connection. ".. I tried closing the connection and after a second it was back on .." ".. I followed the steps here to disable such notifications, but the connection remains .."
    – snubbelbuff
    Jul 14, 2016 at 13:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .