KWIKY
join:2003-09-18
Broomfield, CO
| Why does Microsoft probe my por 443 on boot up?
I've noticed netstat activity showing microsoft servers connecting to my computer on port 443 on bootup. I also notice when I run an nmap probe of my computer recently it shows port 443 as Open. Is that normal? This is kinda pissing me off!
TCP cmore:1070 207.46.209.126:http ESTABLISHED
TCP 10.16.0.53:1070 207.46.209.126:80 ESTABLISHED 1044
c:\windows\system32\WS2_32.dll
C:\WINDOWS\System32\WINHTTP.dll
[svchost.exe]
Any ideas? |
|
Anon users
@anonymouse.org | Most likely Window Automatic Updates  |
|
dave
Premium,MVM
join:2000-05-04
not in ohio
 ·Verizon Online DSL
 ·Verizon FIOS
1 edit | reply to KWIKY
That netstat output shows a connection from you to some Microsoft web serer on port 80. What does that have to do with (a) Microsoft connecting to you, (b) on port 443?
I don't believe that "Microsoft" connects to you when you boot your system. For a start, how would they know your system has booted? There would have to be outgoing traffic first. If I were you and I really cared, I'd run a network sniffer (on another PC on the LAN) to show that wasn't happening. For another thing, it's easy enough to see if you have anything listening on port 443 'normally', unless you subscribe to some view that says the OS implementors have decided to 'hide' that information, which I think requires a fair amount of tinfoil headgear use.
From where did you run this probe? Could it be something between the nmap system and the test system? Is there any NATting involved? |
|
anon2009
@ltdomains.com | reply to KWIKY
FROM: Big Brother.
TO: KWIKY
All your ports are belong to us.
regards |
|
KWIKY
join:2003-09-18
Broomfield, CO
| reply to KWIKY
Hi Anon users, I know that MS commuicates via port 80 for automatic updates. I actually just found a nice website (securina) that scans your computers software application/MS updates,etc and lets you know the builds and vulnerabilities! Good stuff.
Dave, excellent info! Yes, the scan was ran from one of my linux boxes on the network. I certainly don't enjoy the fact that my port 443 shows as open! Although I know this port is used for secure transactions (SSL) etc I don't enjoy it sitting in an open state. I'm pretty certain this is not normal so that's my concern. I'm going to need to do some more investigating and possibly re-install another packet sniffer on my XP box just for the heck of it. |
|
