[TWC] what could these "localhost" connections be? in Security http://www.dslreports.com/forum/r21701219 en Mon, 09 Nov 2009 03:34:00 EDT Mon, 09 Nov 2009 03:34:00 EDT Re: [TWC] what could these "localhost" connections be? http://www.dslreports.com/forum/remark,21714498 NormanS :
said by TheWiseGuy See Profile :

Now since in this case they are established versus listening, as was the case in the other example, you may be correct, all 4 sockets/ports may be simply for pollable events.
I show four lines for the Firefox sockets. Each line treats one of the endpoints as local, the other as remote. Two loopback connections have four endpoints.
I used 'netstat -ano' to get the ProcessID#. Windows Task Manager identified ProcessID# 5936 as Firefox.

--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum
]]> http://www.dslreports.com/forum/remark,21714498 Sat, 10 Jan 2009 06:28:36 EDT Re: [TWC] what could these "localhost" connections be? http://www.dslreports.com/forum/remark,21702845 TheWiseGuy : Yes I understand that you need a pair of ports/sockets for one connection. I should have made it clear that I was talking about ports/sockets not connections. From the post by EG that I cited

said by a firefox programmer :

I don't know how to implement NSPR pollable events
on Windows without using a pair of TCP sockets,
Now since in this case they are established versus listening, as was the case in the other example, you may be correct, all 4 sockets/ports may be simply for pollable events. Still in reading the complete reference I am not sure there should be more then 2 sockets/ports for the pollable events cited by that programmer, though it would make sense since the connection to check for a pollable event would be made to the listening socket and there normally are 2 listening ports/sockets.
--
Warning, If you post nonsense and use misinformation and are here to argue based on those methods, you will be put on ignore.]]> http://www.dslreports.com/forum/remark,21702845 Thu, 08 Jan 2009 11:41:31 EDT Re: [TWC] what could these "localhost" connections be? http://www.dslreports.com/forum/remark,21702591 jimkyle : Each loopback connection uses two ports, one for each end of the connection. You can see that the first two are connected to each other, as are the next two, in the OP's report. Thus the first four probably represent the two Firefox connections...]]> http://www.dslreports.com/forum/remark,21702591 Thu, 08 Jan 2009 10:55:34 EDT Re: [TWC] what could these "localhost" connections be? http://www.dslreports.com/forum/remark,21702161 TheWiseGuy : Localhost is 127.0.0.1 and is Loopback on your computer. You can make sure that it is 127.0.0.1 by running netstat -n

»en.wikipedia.org/wiki/Localhost

It is the way a program talks to itself. Firefox uses 2 of these for Pollable events

»www2.dslreports.com/forum/remark···12761500

I am not sure how the other 2 are used but since the packets never leave your computer there should be no need to worry about connections only to Localhost.
--
Warning, If you post nonsense and use misinformation and are here to argue based on those methods, you will be put on ignore.]]> http://www.dslreports.com/forum/remark,21702161 Thu, 08 Jan 2009 09:34:42 EDT Re: [TWC] what could these "localhost" connections be? http://www.dslreports.com/forum/remark,21701379 amysheehan : I've asked the mods to move your topic to Security for follow up :)]]> http://www.dslreports.com/forum/remark,21701379 Thu, 08 Jan 2009 02:47:18 EDT [TWC] what could these "localhost" connections be? http://www.dslreports.com/forum/remark,21701219 anon : Hello,

I am seeing this when I do a netstat
C:\Documents and Settings\user>netstat

Active Connections

Proto Local Address Foreign Address State
TCP asus:1042 localhost:1043 ESTABLISHED
TCP asus:1043 localhost:1042 ESTABLISHED
TCP asus:1045 localhost:1046 ESTABLISHED
TCP asus:1046 localhost:1045 ESTABLISHED
TCP asus:5152 localhost:1044 CLOSE_WAIT

I see all of these localhost connections when I open my firefox browser. I first thought it might be spyware or something, so I did a complete re-partition and re-format

After the format though I seem to have not seen it the first couple days but now...I am seeing again.

Any ideas? Is this normal?]]> http://www.dslreports.com/forum/remark,21701219 Thu, 08 Jan 2009 01:36:45 EDT