I have many questions. However, to begin in the easiest and shortest manner. I am trying to figure out why when I type cmd prompt netstat -a I get a plethora of IP addresses and links that I am almost certain are not right or correct.

Or maybe my IT/computer networking hubby snooping. I have absolutely nothing to hide and can't figure out why he would be concerned. With his level of network security training a "leak" in my home wireless net, makes no sense.

So, I want to find out if he is indeed snooping. What should I look for to be considered; harmful? Is UDP necessary?

Below are a few:

TCP    my ip address here:49372    server-205-251-203-249:80  ESTABLISHED
TCP   my ip:49388    star-01-02-lax1:80     ESTABLISHED
 TCP    :49443    r-199-59-148-16:443    TIME_WAIT
 TCP    :49448    209-18-46-66:80        ESTABLISHED
 TCP    :49449    a96-7-48-51:80         ESTABLISHED
 TCP    :49450         ESTABLISHED
 TCP    :49451    a96-7-48-64:80         ESTABLISHED
 TCP    :49454       ESTABLISHED
 TCP    :49455    TheTank:445            SYN_SENT
 TCP    :49456    TheTank:445            SYN_SENT
 TCP    :49457    TheTank:445            SYN_SENT
 TCP    :49458    TheTank:139            SYN_SENT
 TCP    :49459    android_f2f09956193035b1:9100  SYN_SENT
 TCP    :49460    dfw06s17-in-f7:443     ESTABLISHED

Funny thing is he just bought an Android phone last week (prior we had iPhones) and suddenly I see the above ANDROID_F… in the command output.

  • 5
    I don't see why this should matter... if you have nothing to hide it shouldn't really matter. Also, if he is snooping, wouldn't he have seen this post? – cutrightjm Mar 13 '13 at 4:02
  • Your axiom is false: falkvinge.net/2012/07/19/… – Everett Sep 9 '14 at 15:48
up vote 6 down vote accepted

The problem with how you're using netstat is, you're missing out on the really digestable information

try netstat -ba - this will give you the name of the binary of programme using the port and hostname and a will give you all the ports being used. If you want IP addresses use netstat -ban

I note that computers are chatty little things. They're constantly telling each other "I'm here" "This is my IP address BACK OFF!" and even talking to themselves (really!). Unless you KNOW exactly what you're looking for, there's just too much noise.

  • LOL, gotcha. Maybe, I should find a less advanced forum? I tried netstat -ba. But, like you said, if I don't know what I am looking for ... Being that I especially am unclear on what truly is "good" or "bad." All I can do is post what came up when I entered the command? I feel a bit more like a noob again. Just when I think I have a decent grasp on networking. I get lost in translation. Literally. :/ – WIFI WIFE WONDERS Mar 13 '13 at 7:51
  • I quite honestly think the real issue is trust here, but we're a tech Q&A site not a relationship Councillor. I don't see anything suspicious in what you posted, and does look like normal traffic to me. If you're really worried about snooping, talk to the husband, get the key for installation (if its a laptop, it should be under the system or battery), reinstall things yourself from known good media, and don't let anyone access anything but a limited account unless necessary, yourself included. This will also improve your computer skills ;) – Journeyman Geek Mar 13 '13 at 8:40
  • LOL, no need for a counselor here. Just a better understanding on crap I try to understand! One other issue, is just that my user accounts. I am unable to log into my others. But, the one I am on. Just says user profile failed to load* Which is why I haven't done a restore, don't wanna loose anything on those other profiles until I am sure I am able to fully access them. (I have snooped into my own files with no business doing so ;)) Thanks again for taking a moment to look it over. I know talking to stubborn people isn't the best way to spend time. – WIFI WIFE WONDERS Mar 13 '13 at 8:55
  • @JourneymanGeek I guess options have changed since you wrote this answer: $ netstat -ba command above results in: netstat: invalid option -- 'b' – WinEunuuchs2Unix Jul 28 '17 at 0:36
  • On Linux or windows? The arguments are different – Journeyman Geek Jul 28 '17 at 0:37

you're looking at everything that your network port sees. there is a lot more going on at the networking level than you expect.

the presence of "android_" simply means the iphone is on the network, or has been plugged in with the tether option.

And, my philosophy while on the computer is to act like someone is always watching. This way you don't get into any trouble (or cover your tracks extra well).

  • Thanks Snake. I know it's like looking at a menu in a foreign language. I kind of get it, but can't tell ya specifically. if that makes sense? I am not worried about what is seen. I am more concerned why anyone would put so much effort un necessarily. So, to clarify seeing the "android" on there can simply mean it is on the home network. I am not sure I clarified, but this is my personal laptop. No one is supposed to be on here but myself. And all my other user profiles mysteriously just stopped working. So I can no longer log into my other ones. Including my guests. – WIFI WIFE WONDERS Mar 13 '13 at 6:46
  • I'd ask why you feel so certain someone is "snooping" on your pc? There are a lot of other explanations that might be probable, such as viruses which will cause weird behavior. And a heads up, most good antivirus software will catch keyloggers or even remote screen view software (such as vnc), so get a good AV and run it. I recommend MalwareBytes and SuperAntispyware. Both have free versions but don't provide realtime protection (they are only scanners). Give them a go, check the back of the machine for hardware keyloggers (usually USB stick or plugged in between the mouse/keyboard and pc). – SnakeDoc Mar 13 '13 at 6:54
  • Well, to keep it short. My spouse was on his pc helping me with a resume. I noticed some user profiles with my name. I asked what they were. he seemed kinda hesitant to answer. He lets other people on his pc and I have had a REALLY horrible experience w/someone getting into my old pc. I asked if he could just delete them. Since he said it was just because he hadn't deleted it from an old hard drive switch. No biggie,right? it's was just supposed to be old files nothing important. But, he refuses to delete them. When he saved, it auto opened my profile and I saw a TON of files mostly in code. – WIFI WIFE WONDERS Mar 13 '13 at 7:03
  • Leaving behind bits of old profiles is normal for windows. You're reading too much into it, IMO. Most comouter folk are packrats. I have a handful of hard drives from obsolete old officice systems 'in case'. – Journeyman Geek Mar 13 '13 at 7:04
  • @JourneymanGeek was just about to say the same lol. I have a lot of old data everywhere, from multiple hard drives in my desk to 1TB drive in my pc filled with old data. I'd say it's abnormal for an IT guy to permanently delete data. It's likely just old data and nothing to worry about. If he was hiding the data, it wouldn't be accessible (hidden volume, external drive, ADS, etc). I wouldn't worry... – SnakeDoc Mar 13 '13 at 7:09

First update your antivirus, inspect any exemptions of files or folders and question if you find anything that is exempt from being scanned, then run a full scan. Then you could narrow down things by looking through your firewall rules and see if anything looks out of place. Based on if you identify anything that looks out of place then research to see if they are legitimate or not. To get more advanced if you don't find anything at this point then you could narrow down what to inspect as a packet capture by running a local Honeypot. (It's recommended to disable or even uninstall any antivirus applications because of how these think and act.)


Then based on your findings of traffic and Googling what all you are seeing identify some possible suspicious activity.

Second get wireshark and take a packet capture and then dissect it based on your previous findings of possible suspicious activity. If this is too complex you could just start creating firewall rules to block everything that you found previously from running a Honeypot and see if any of the rules are magically disabled or deleted by someone and then you would know the culprit. Below is a good script I wrote to export your current firewall rules in a trackable and easily readable manner:

mkdir "C:\Windows Firewall Configs"
cd "C:\Windows Firewall Configs"
netsh advfirewall firewall show rule name=all > "C:\Windows Firewall Configs\Firewall Rules Export-%computername%-%date:~4,2%-%date:~7,2%-%date:~-4%.txt"
netsh advfirewall export > "C:\Windows Firewall Configs\Firewall Rules Export-%computername%-%date:~4,2%-%date:~7,2%-%date:~-4%.wfw"

This will create 2 files in the folder named "Windows Firewall Configs" on your C drive.

Firewall Rules Export-YourComputerName-MM-DD-YYYY.txt
Firewall Rules Export-YourComputerName-MM-DD-YYYY.wfw

The txt files are human readable while the wfw file is an actual export / backup of your existing windows firewall rules. If you need to import a previous backup then run:

netsh advfirewall import "C:\Windows Firewall Configs\Firewall Rules Export-YourComputerName-MM-DD-YYYY.wfw"

You could simply copy and paste everything into a .CMD file and use task scheduler to schedule a daily backup, then over time determine the changes that were made using something free like WinMerge to compare two files and see what's different and arrive at a conclusion based on that evidence.

protected by nhinkle Sep 9 '14 at 18:50

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.