5

TCPView and ZoneAlarm firewall reveal that Firefox is accepting incoming connections on two ports on localhost (127.0.0.1). The port numbers are not fixed.

I reinstalled Firefox without any add-ons, and scanned using 3 antivirus programs (Avast, AVG and Norton), but Firefox is still listening to two ports. Other browsers such as Opera, K-Meleon, IE and Safari do not behave like this.

Is something spying on my system?

Improve this question
3
  • I am using Firefox / Opera / K meleon / IE / Safari Only Firefox behaves like this. I tried to temper the data transmitted. And their are some suspicious activites. Even I reinstalled FF without any add-ins (Clearing every thing that belongs to FF/ Registry hacks /Scanned using 3 antivirus Avast / AVG / Nortan's) BUt still the problem remains same. So surely there is a trick. I don't get the point that's why asking. If you know the answer please share. – Hidden Nov 16 '09 at 19:37
  • I am not asking that firefox is opening port on a perticular site. aka port 80 / 8080 .. I am not opening ports like some_site_name_here.com:80 some_site_name_here.com:8080 That is not a issue here. It is opening ports on my system (aka localhost 127.0.0.1 ) Although Their is no fix port. it is used randomly. Kindly note ports traffic is by passed from firewall / router configurations. Guess you are getting my words... – Hidden Nov 16 '09 at 20:05
  • Maybe on more recent versions of Firefox, there might be more than one loopback connection, resulting in more than 2 entries in netstat. See Why has Firefox opened a bunch of localhost TCP connections? – Arjan Oct 30 '10 at 9:25
9

These are local loopback ports. Firefox uses them for local communication.

A loopback connection (to IP address 127.0.0.1) can be made by Firefox on non-Unix machines. In this case the browser is communicating with itself as expected, and it is not recommended that this communication be blocked.

Take a look at this: Connections established on startup - Firefox

And the bug report "Connections opened on loopback (127.0.0.1) show in NETSTAT and ZoneAlarm has "server rights" alerts" explains:

Whenever Mozilla is running there are two connections to the loopback address that are connected to each other. The ports change but they are usually lower-numbered unregistered ports.

Improve this answer
7
  • This is the answer I am looking for. Do you think Is this a way of getting what users is surfing using Firefox.(another side of coin) – Hidden Nov 16 '09 at 21:17
  • @Hidden, do you mean you want to eavesdrop on the internal communication of Firefox, or are you afraid someone could do that? (Or is this not about eavesdropping at all?) – Arjan Nov 16 '09 at 21:28
  • Try to understand my point. Case One : If the browser is sending packets what is being fatched (aka browse) by users right now. their is chances that it could be trapped. I am not asking about data transmitted via servers. This is the browser itself that it advertising. and Hardly its a matter 2-3 days for any FF developer to develop a plugin / tool bar what is being transmitted.and send them using same technology that firefox is using. Case Two : The data collected is being used by some data mining program to gain some business value. Or to spy Remember Nothing is free in this world. – Hidden Nov 16 '09 at 21:41
  • 3
    You can snoop the packets being transmitted by ANY application in windows if you are at the machine and use software like Wireshark (wireshark.org). I think you are being a little too paranoid about this Firefox internal communication. I mean think about it. If someone writes an exploit or installs a plugin on your PC that mines information, I doubt they would do it using this loopback anyway. There are many many ways to spy on what you are doing on a computer. Firefox is a huge open source project with many security experts contributing. They clearly do not consider this an issue. – Marcin Nov 16 '09 at 21:48
  • In fact, there's sniffer add-ons (a bit like "Wireshark for Firefox") such as HttpFox (addons.mozilla.org/en-US/firefox/addon/6647) that in theory could mirror all traffic to some untrusted third party. If it did, then people would not install it, but like Marcin explained: such malware doesn't need to eavesdrop on any internal Firefox communications. – Arjan Nov 16 '09 at 22:00
-2

Web browsers will open whatever ports they're told to by whatever content you attempt to access.

Improve this answer
1
  • 2
    I'm sorry, but that's wrong. "open a port" means that you accept incoming connections. What you describe is to connect to an open port. – guerda Nov 17 '09 at 7:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy