2

I did a netstat -b and received this list:

Active Connections

  Proto  Local Address          Foreign Address        State
  TCP    127.0.0.1:2559         www:56952              TIME_WAIT
  TCP    127.0.0.1:2559         www:56953              TIME_WAIT
  TCP    127.0.0.1:2559         www:56954              TIME_WAIT
  TCP    127.0.0.1:2559         www:56955              TIME_WAIT
  TCP    127.0.0.1:2559         www:56956              TIME_WAIT
  TCP    127.0.0.1:2559         www:56957              TIME_WAIT
  TCP    127.0.0.1:2559         www:56958              TIME_WAIT
  TCP    127.0.0.1:2559         www:56959              TIME_WAIT
  TCP    127.0.0.1:5354         www:49155              ESTABLISHED
 [mDNSResponder.exe]
  TCP    127.0.0.1:49155        www:5354               ESTABLISHED
 [AppleMobileDeviceService.exe]
  TCP    192.168.1.101:56681    yh-in-f99:https        ESTABLISHED
 [chrome.exe]
  TCP    192.168.1.101:56721    yh-in-f155:http        ESTABLISHED
 [chrome.exe]
  TCP    192.168.1.101:56728    yh-in-f155:http        ESTABLISHED
 [chrome.exe]
  TCP    192.168.1.101:56729    gh-in-f156:http        ESTABLISHED
 [chrome.exe]
  TCP    192.168.1.101:56754    ye-in-f157:http        ESTABLISHED
 [chrome.exe]
  TCP    192.168.1.101:56765    yh-in-f113:http        ESTABLISHED
 [chrome.exe]
  TCP    192.168.1.101:56766    yh-in-f113:http        ESTABLISHED
 [chrome.exe]
  TCP    192.168.1.101:56767    ye-in-f157:http        ESTABLISHED
 [chrome.exe]
  TCP    192.168.1.101:56768    ye-in-f157:http        ESTABLISHED
 [chrome.exe]
  TCP    192.168.1.101:56780    gh-in-f156:http        ESTABLISHED
 [chrome.exe]
  TCP    192.168.1.101:56785    184:http               ESTABLISHED
 [chrome.exe]
  TCP    192.168.1.101:56791    atl14s08-in-f28:http   ESTABLISHED
 [chrome.exe]
  TCP    192.168.1.101:56793    a23-62-111-64:http     ESTABLISHED
 [chrome.exe]
  TCP    192.168.1.101:56796    a184-28-61-231:http    ESTABLISHED
 [chrome.exe]
  TCP    192.168.1.101:56800    a23-62-111-83:http     ESTABLISHED
 [chrome.exe]
  TCP    192.168.1.101:56801    yh-in-f99:http         ESTABLISHED
 [chrome.exe]
  TCP    192.168.1.101:56803    yh-in-f99:http         ESTABLISHED
 [chrome.exe]
  TCP    192.168.1.101:56804    ye-in-f157:https       ESTABLISHED
 [chrome.exe]
  TCP    192.168.1.101:56817    yh-in-f139:https       ESTABLISHED
 [chrome.exe]
  TCP    192.168.1.101:56824    atl14s07-in-f5:https   ESTABLISHED
 [chrome.exe]
  TCP    192.168.1.101:56825    atl14s08-in-f5:https   ESTABLISHED
 [chrome.exe]
  TCP    192.168.1.101:56827    93.184.216.169:http    TIME_WAIT
  TCP    192.168.1.101:56828    93.184.216.169:http    TIME_WAIT
  TCP    192.168.1.101:56829    205.185.208.18:http    TIME_WAIT
  TCP    192.168.1.101:56830    205.185.208.18:http    TIME_WAIT
  TCP    192.168.1.101:56831    ox-173-241-242-99:http  TIME_WAIT
  TCP    192.168.1.101:56834    ox-173-241-242-99:http  TIME_WAIT
  TCP    192.168.1.101:56835    209.188.29.70:http     TIME_WAIT
  TCP    192.168.1.101:56836    209.188.29.70:http     TIME_WAIT
  TCP    192.168.1.101:56837    209.188.29.70:http     TIME_WAIT
  TCP    192.168.1.101:56838    72.21.91.9:http        TIME_WAIT
  TCP    192.168.1.101:56839    72.21.91.9:http        TIME_WAIT
  TCP    192.168.1.101:56840    72.21.91.9:http        TIME_WAIT
  TCP    192.168.1.101:56843    ec2-54-225-213-108:http  TIME_WAIT
  TCP    192.168.1.101:56844    108.161.188.224:http   TIME_WAIT
  TCP    192.168.1.101:56845    108.161.188.224:http   TIME_WAIT
  TCP    192.168.1.101:56849    ec2-54-225-177-19:http  TIME_WAIT
  TCP    192.168.1.101:56853    a184-86-61-229:http    ESTABLISHED
 [chrome.exe]
  TCP    192.168.1.101:56856    m-nb:http              ESTABLISHED
 [chrome.exe]
  TCP    192.168.1.101:56857    gh-in-f148:http        ESTABLISHED
 [chrome.exe]
  TCP    192.168.1.101:56858    a23-62-111-128:http    ESTABLISHED
 [chrome.exe]
  TCP    192.168.1.101:56859    bidn:http              ESTABLISHED
 [chrome.exe]
  TCP    192.168.1.101:56860    a23-62-111-192:http    ESTABLISHED
 [chrome.exe]
  TCP    192.168.1.101:56861    a23-62-111-192:http    TIME_WAIT
  TCP    192.168.1.101:56862    gh-in-f148:http        TIME_WAIT
  TCP    192.168.1.101:56863    gh-in-f148:http        TIME_WAIT
  TCP    192.168.1.101:56864    ec2-54-243-171-157:http  TIME_WAIT
  TCP    192.168.1.101:56865    ec2-54-243-171-157:http  TIME_WAIT
  TCP    192.168.1.101:56866    ec2-54-243-171-157:http  TIME_WAIT
  TCP    192.168.1.101:56867    yh-in-f149:http        TIME_WAIT
  TCP    192.168.1.101:56868    a23-73-142-66:http     TIME_WAIT
  TCP    192.168.1.101:56869    a23-73-142-66:http     TIME_WAIT
  TCP    192.168.1.101:56879    209.235.4.216:http     TIME_WAIT
  TCP    192.168.1.101:56880    209.235.4.216:http     TIME_WAIT
  TCP    192.168.1.101:56890    74.217.78.158:http     TIME_WAIT
  TCP    192.168.1.101:56893    74.217.78.158:http     TIME_WAIT
  TCP    192.168.1.101:56894    74.217.78.158:http     TIME_WAIT
  TCP    192.168.1.101:56902    ec2-184-73-221-84:http  TIME_WAIT
  TCP    192.168.1.101:56903    ec2-184-73-221-84:http  TIME_WAIT
  TCP    192.168.1.101:56904    yh-in-f139:http        TIME_WAIT
  TCP    192.168.1.101:56905    yh-in-f139:http        TIME_WAIT
  TCP    192.168.1.101:56906    yh-in-f99:http         TIME_WAIT
  TCP    192.168.1.101:56907    yh-in-f99:http         TIME_WAIT
  TCP    192.168.1.101:56908    yh-in-f99:http         TIME_WAIT
  TCP    192.168.1.101:56918    ye-in-f95:http         TIME_WAIT
  TCP    192.168.1.101:56919    ye-in-f95:http         TIME_WAIT
  TCP    192.168.1.101:56920    ye-in-f95:http         TIME_WAIT
  TCP    192.168.1.101:56924    atl14s07-in-f7:http    TIME_WAIT
  TCP    192.168.1.101:56925    atl14s07-in-f7:http    TIME_WAIT
  TCP    192.168.1.101:56927    stackoverflow:http     TIME_WAIT
  TCP    192.168.1.101:56936    stackoverflow:http     TIME_WAIT
  TCP    192.168.1.101:56938    72.21.91.121:https     ESTABLISHED
 [chrome.exe]
  TCP    192.168.1.101:56939    72.21.91.121:https     ESTABLISHED
 [chrome.exe]
  TCP    192.168.1.101:56940    72.21.91.121:https     ESTABLISHED
 [chrome.exe]
  TCP    192.168.1.101:56941    72.21.91.121:https     ESTABLISHED
 [chrome.exe]
  TCP    192.168.1.101:56942    edge-star-shv-03-frc1:http  ESTABLISHED
 [chrome.exe]
  TCP    192.168.1.101:56943    a184-26-142-138:http   ESTABLISHED
 [chrome.exe]
  TCP    192.168.1.101:56947    stackoverflow:http     TIME_WAIT
  TCP    192.168.1.101:56951    stackoverflow:http     ESTABLISHED
 [chrome.exe]

Then, I blocked ports 45000 - 65000 in Windows Firewall and I got this:

Active Connections

  Proto  Local Address          Foreign Address        State
  TCP    127.0.0.1:2869         www:56968              TIME_WAIT
  TCP    127.0.0.1:2869         www:56969              ESTABLISHED
 Can not obtain ownership information
  TCP    127.0.0.1:5354         www:49155              ESTABLISHED
 [mDNSResponder.exe]
  TCP    127.0.0.1:49155        www:5354               ESTABLISHED
 [AppleMobileDeviceService.exe]
  TCP    127.0.0.1:56969        www:icslap             ESTABLISHED
 [wmpnetwk.exe]
  TCP    192.168.1.101:56793    a23-62-111-64:http     TIME_WAIT
  TCP    192.168.1.101:56853    a184-86-61-229:http    TIME_WAIT
  TCP    192.168.1.101:56856    m-nb:http              TIME_WAIT
  TCP    192.168.1.101:56858    a23-62-111-128:http    TIME_WAIT
  TCP    192.168.1.101:56859    bidn:http              TIME_WAIT
  TCP    192.168.1.101:56860    a23-62-111-192:http    TIME_WAIT
  TCP    192.168.1.101:56951    stackoverflow:http     ESTABLISHED
 [chrome.exe]
  TCP    192.168.1.101:56961    ye-in-f100:http        ESTABLISHED
 [chrome.exe]
  TCP    192.168.1.101:56962    yh-in-f120:http        ESTABLISHED
 [chrome.exe]
  TCP    192.168.1.101:56970    stackoverflow:http     ESTABLISHED
 [chrome.exe]

The only internet connect I have open is this site.

I ran SpyBot and it removed about 60 something items. This is after I ran it. My videos keep slowing down, so I'm trying to fix that.

  • 1
    Your PC will make more connections outgoing than just through your browser. You can see your chrome connections there (including where it talks to Google). The ones with 127.0.0.1 you can ignore because they are local to your machine. None of the above looks dodgy, and should not have prompted port blocking (particularly as it is the third column that shows the port being connected to, and it is all http and https). – Paul Jun 23 '13 at 23:38
  • I know this post is old, but @Paul, what constitutes a "dodgy" looking connection? – Joe Jun 28 '14 at 5:11
  • @JoeBennett Saying that something looks "dodgy" is far harder than saying something doesn't. In this case, all the examples were web traffic, which is common - which doesn't mean that they are fine, but the approach the OP took isn't going to help figure that out. If there were unrecognisable destinations, it isn't indicative of anything untoward as well. It depends entirely on the environment and what is expected. – Paul Jun 28 '14 at 13:26
3

Like others have mentioned, there doesn't seem to be any obvious problem with your output. Addressing the video issue may require another question. As far as Chrome is concerned:

Prevent Chrome from running in background

  1. Go to chrome://settings in your Chrome browser.
  2. Click the Show advanced settings... link at the bottom on the page.
  3. Under the System heading near the bottom of the advanced settings, uncheck Continue running background apps when Google Chrome is closed.

Investigating individual connections

"...but since they can't be blocked, I'd guess that they're safe."

Successfully blocking a port range in Windows Firewall means creating 4 rules: TCP Incoming, UDP Incoming, TCP Outgoing, and UDP Outgoing. By default, all incoming connections not explicitly allowed are blocked, while all outgoing connections not specifically blocked are allowed. However, a rule may exist that allows an incoming connection. Blocking rules most always supersede Allow rules, so you create the Incoming rules for a better level of certainty. If something is bypassing your firewall rules, it should probably warrant investigation.

Having said that, if there are Potentially Unwanted Programs (PUP) or malware, it's better to remove them vs blocking the connection. A good program that many use is Malwarebytes. It's real-time scanning feature is paid, but it's free for use as a manual virus scanner.

I'm willing to assume that if you did a netstat -fb (or netstat -fnb for ip-only), it would show that your 'xx-in-x###' domains are actually 'xx-in-x###.1e100.net'. According to the http://whois.domaintools.com/1e100.net whois, Google owns the 1e100.net domain. The information corresponds with http://whois.domaintools.com/google.com registration info. I'd deem those safe, especially considering the Google Chrome brower.

A few other addresses (e.g. 93.184.216.169 and 205.185.208.18) might not be so friendly. For instance, the 205.185.208.18 domain is myinfotopia.com (a toolbar for Chrome). Check chrome://extensions/ in your Chrome browser if this is unintended. If you update your post with the output of netstat -fb, it'll be easier to assist.

  • Thanks for the tip! Apparently all of the connections that got blocked with blocking 45000 to 65000 were the chrome connections. This may explain Amazon, although it disappeared after I ran SpyBot, rather than after I disabled the background apps. That's very useful and may be why my videos are slowing down. There are still some connections, but since they can't be blocked, I'd guess that they're safe. I wish I knew a way to check, however, as I'd rather not be guessing. – JVE999 Jun 24 '13 at 0:46
  • If you want more detailed output, use netstat -fb instead. It will show the full domain or ip of each entry, and may make checking them easier. @Jamil – Dono Jun 24 '13 at 0:56
0

first to cut to the chase, your issue with your video is not likely related to the number of connections you have open, unless you are running a torrent client or other client that participates in a protocol that creates massive numbers of them. I'd check your vid card drivers, your codecs, your flash install, etc.

That said, per the netstat help, the -b option:

-b Displays the executable involved in creating each connection or listening port. In some cases well-known executables host multiple independent components, and in these cases the sequence of components involved in creating the connection or listening port is displayed. In this case the executable name is in [] at the bottom, on top is the component it called, and so forth until TCP/IP was reached. Note that this option can be time-consuming and will fail unless you have sufficient permissions.

This option does not filter the connection list, it just displays it with the process info.

I think you are surprised at the number of connections present, but that is not really unusual. unfiltered netstat output is usually quite large.

Connections are used for Inter-Process communication (process A wants to talk to Process B) so may of your connections will have endpoints that are both either 127.0.0.1 or the IP address of the default interface for the system. these ports are not necessarily accessible to anyone on another computer. Processes where the local port is 127.0.0.1 can only be connected to by the local pc, so the firewall will not block them.

  • What I don't understand is why chrome has many connections even when chrome is closed. Also, the foreign addresses were not local. Wouldn't that mean, these are connected from the local address to the foreign address? In one of the netstat's I did, some of the addresses were to amazon.com and some others to sprint. – JVE999 Jun 23 '13 at 23:42
  • is there a chrome process running, even if there is no window? the foreign addresses aren't FQDNs, so its hard to look up the host. do any of the addresses ring a bell with you? either way, the issue appears to be with chrome itself. – Frank Thomas Jun 24 '13 at 0:18
  • None of the addresses ring a bell. I went to Amazon recently (past day or two), I'm sure, but the window's been closed for a while. This was a netstat I did shortly before the one listed, although I ran SpyBot afterward. It appears Amazon isn't listed anymore. I looked up the ip addresses here and nothing rings a bell. After blocking ports 45000 to 65000, there are definitely far fewer connections. I don't know what all of those could be used for. I haven't chosen to run any services. – JVE999 Jun 24 '13 at 0:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.