When i 'netstat' is it normal to have this many connections?

[aphex]

I dont recall seeing this many in the past....

TCP desktop:1025 localhost:1028 ESTABLISHED
TCP desktop:1025 localhost:1030 ESTABLISHED
TCP desktop:1025 localhost:1043 ESTABLISHED
TCP desktop:1027 localhost:1536 ESTABLISHED
TCP desktop:1027 localhost:3275 ESTABLISHED
TCP desktop:1027 localhost:3276 ESTABLISHED
TCP desktop:1027 localhost:4229 ESTABLISHED
TCP desktop:1027 localhost:4230 ESTABLISHED
TCP desktop:1027 localhost:4231 ESTABLISHED
TCP desktop:1027 localhost:4232 ESTABLISHED
TCP desktop:1027 localhost:4233 ESTABLISHED
TCP desktop:1027 localhost:4234 ESTABLISHED
TCP desktop:1027 localhost:4235 ESTABLISHED
TCP desktop:1027 localhost:4236 ESTABLISHED
TCP desktop:1027 localhost:4237 ESTABLISHED
TCP desktop:1027 localhost:4238 ESTABLISHED
TCP desktop:1027 localhost:4239 ESTABLISHED
TCP desktop:1027 localhost:4240 ESTABLISHED
TCP desktop:1027 localhost:4241 ESTABLISHED
TCP desktop:1027 localhost:4242 ESTABLISHED
TCP desktop:1027 localhost:4243 ESTABLISHED
TCP desktop:1028 localhost:1025 ESTABLISHED
TCP desktop:1029 localhost:1046 ESTABLISHED
TCP desktop:1029 localhost:3311 ESTABLISHED
TCP desktop:1030 localhost:1025 ESTABLISHED
TCP desktop:1043 localhost:1025 ESTABLISHED
TCP desktop:1046 localhost:1029 ESTABLISHED
TCP desktop:1536 localhost:1027 ESTABLISHED
TCP desktop:3275 localhost:1027 ESTABLISHED
TCP desktop:3276 localhost:1027 ESTABLISHED
TCP desktop:3311 localhost:1029 ESTABLISHED
TCP desktop:4229 localhost:1027 ESTABLISHED
TCP desktop:4230 localhost:1027 ESTABLISHED
TCP desktop:4231 localhost:1027 ESTABLISHED
TCP desktop:4232 localhost:1027 ESTABLISHED
TCP desktop:4233 localhost:1027 ESTABLISHED
TCP desktop:4234 localhost:1027 ESTABLISHED
TCP desktop:4235 localhost:1027 ESTABLISHED
TCP desktop:4236 localhost:1027 ESTABLISHED
TCP desktop:4237 localhost:1027 ESTABLISHED
TCP desktop:4238 localhost:1027 ESTABLISHED
TCP desktop:4239 localhost:1027 ESTABLISHED
TCP desktop:4240 localhost:1027 ESTABLISHED
TCP desktop:4241 localhost:1027 ESTABLISHED
TCP desktop:4242 localhost:1027 ESTABLISHED
TCP desktop:4243 localhost:1027 ESTABLISHED

 

[camara120]

seems kinda fishy

I would run an online virus scan at
http://housecall.trendmicro.com
or at
http://www.kaspersky.com/beta?product=161744315

Then run ad aware, spybot, and/or Microsoft AntiSpyware

 

[Nothinman]

If you're using XP use the -p switch and see which process owns the connections.

 

[amdskip]

I have twice that many.

 

[ShadowBlade]

not trying to steal your thread...
i tried netstat -p and it came up blank

 

[MSCoder610]

Looking at the commandline options, I think that should be -o.

 

[Aves]

Just for general info, those running a Windows version that is earlier than XP or those who want a GUI can use TCPView rather than 'netstat -o'

 

[aphex]

TCP desktop:990 localhost:3922 ESTABLISHED 256
TCP desktop:999 localhost:3923 ESTABLISHED 3260
TCP desktop:1025 localhost:1028 ESTABLISHED 164
TCP desktop:1025 localhost:1030 ESTABLISHED 164
TCP desktop:1025 localhost:1043 ESTABLISHED 164
TCP desktop:1027 localhost:3275 ESTABLISHED 164
TCP desktop:1027 localhost:3276 ESTABLISHED 164
TCP desktop:1027 localhost:4229 ESTABLISHED 164
TCP desktop:1027 localhost:4230 ESTABLISHED 164
TCP desktop:1027 localhost:4231 ESTABLISHED 164
TCP desktop:1027 localhost:4232 ESTABLISHED 164
TCP desktop:1027 localhost:4233 ESTABLISHED 164
TCP desktop:1027 localhost:4234 ESTABLISHED 164
TCP desktop:1027 localhost:4235 ESTABLISHED 164
TCP desktop:1027 localhost:4236 ESTABLISHED 164
TCP desktop:1027 localhost:4237 ESTABLISHED 164
TCP desktop:1027 localhost:4238 ESTABLISHED 164
TCP desktop:1027 localhost:4239 ESTABLISHED 164
TCP desktop:1027 localhost:4240 ESTABLISHED 164
TCP desktop:1027 localhost:4241 ESTABLISHED 164
TCP desktop:1027 localhost:4242 ESTABLISHED 164
TCP desktop:1027 localhost:4243 ESTABLISHED 164
TCP desktop:1027 localhost:4861 ESTABLISHED 164
TCP desktop:1028 localhost:1025 ESTABLISHED 164
TCP desktop:1029 localhost:1046 ESTABLISHED 728
TCP desktop:1029 localhost:3311 ESTABLISHED 728
TCP desktop:1030 localhost:1025 ESTABLISHED 728
TCP desktop:1031 localhost:4865 TIME_WAIT 0
TCP desktop:1043 localhost:1025 ESTABLISHED 164
TCP desktop:1046 localhost:1029 ESTABLISHED 164
TCP desktop:1536 localhost:1027 TIME_WAIT 0
TCP desktop:3275 localhost:1027 ESTABLISHED 728
TCP desktop:3276 localhost:1027 ESTABLISHED 728
TCP desktop:3311 localhost:1029 ESTABLISHED 164
TCP desktop:3919 localhost:5679 ESTABLISHED 256
TCP desktop:3920 localhost:7438 ESTABLISHED 256
TCP desktop:3922 localhost:990 ESTABLISHED 3260
TCP desktop:3923 localhost:999 ESTABLISHED 256
TCP desktop:3924 localhost:5678 ESTABLISHED 256
TCP desktop:3925 localhost:5678 ESTABLISHED 256
TCP desktop:4229 localhost:1027 ESTABLISHED 728
TCP desktop:4230 localhost:1027 ESTABLISHED 728
TCP desktop:4231 localhost:1027 ESTABLISHED 728
TCP desktop:4232 localhost:1027 ESTABLISHED 728
TCP desktop:4233 localhost:1027 ESTABLISHED 728
TCP desktop:4234 localhost:1027 ESTABLISHED 728
TCP desktop:4235 localhost:1027 ESTABLISHED 728
TCP desktop:4236 localhost:1027 ESTABLISHED 728
TCP desktop:4237 localhost:1027 ESTABLISHED 728
TCP desktop:4238 localhost:1027 ESTABLISHED 728
TCP desktop:4239 localhost:1027 ESTABLISHED 728
TCP desktop:4240 localhost:1027 ESTABLISHED 728
TCP desktop:4241 localhost:1027 ESTABLISHED 728
TCP desktop:4242 localhost:1027 ESTABLISHED 728
TCP desktop:4243 localhost:1027 ESTABLISHED 728
TCP desktop:4861 localhost:1027 ESTABLISHED 728
TCP desktop:4863 localhost:1031 TIME_WAIT 0
TCP desktop:5678 localhost:3924 ESTABLISHED 3260
TCP desktop:5678 localhost:3925 ESTABLISHED 3260
TCP desktop:5679 localhost:3919 ESTABLISHED 256
TCP desktop:7438 localhost:3920 ESTABLISHED 256

 

[Aves]

You need to match the PIDs to process names manually or use something like TCPView.

 

[JackMDS]

Rather then to get scare and befuddled it is easier to use the program mentioned above (TCPVIEW) + a second free program made by the same guys, and take few minutes to study what is actually running on you system.

http://www.sysinternals.com/ntw2k/freeware/procexp.shtml

Screen Shot: http://www.ezlan.net/network/processes.jpg

You can save to outcome of the two programs and used it as a frame of reference in troubled time.

:sun:

 

[nick128]

-b actually gives you the process -o will just give you teh ID

 

[n0cmonkey]

Originally posted by: nick128
-b actually gives you the process -o will just give you teh ID

-b isn't an option.

 

[tyanni]

netstat -b works fine on an XP machine.

 

[Aves]

Originally posted by: tyanni
netstat -b works fine on an XP machine.

Only on XPSP2 and later.

Netstat ?b Option
The Netstat tool displays a variety of information about active TCP connections, ports on which the computer is listening, Ethernet statistics, the IP routing table, and IPv4 and IPv6 statistics. In Windows XP SP2, the Netstat tool supports a new ?b option that displays the set of components that are listening on each open TCP and UDP port.

Prior to Windows XP SP2, you can use the ?o option to display the set of ports being listened on and the corresponding process ID (PID). You can then lookup the PID in the display of the tasklist /svc command to discover the name of the process that owns the port. However, in some cases, there are multiple services within a single process and it was not possible to determine which service within the process owned the port.

With the ?b option, Netstat displays the TCP or UDP port, the file names corresponding to the components of the service that owns the port, and the PID. From the file names and PID, you can determine which of the services in the display of the tasklist /svc command owns the port.

http://www.microsoft.com/technet/community/columns/cableguy/cg0104.mspx