dslreports logo
site
 
    All Forums Hot Topics Gallery
spc

spacer




how-to block ads


Search Topic:
uniqs
599
share rss forum feed


Cartel
Premium
join:2006-09-13
Chilliwack, BC
kudos:2
Reviews:
·TekSavvy DSL
·Shaw
·TELUS

CurrPorts wont show 4 established connections

Click for full size
My router shows these 4 connections in the Internet Sessions page.
If I run CurrPorts or Netstat -an they show no connections and absolutely nothing using those ports.
I Checked every program running with Sysinternals Process Explorer and there are no foreign programs or files running and none with a established connection.
How can't I find out whats connecting to these IP's?

192.168.0.117:49188 49188 65.54.87.11:80 TCP EST Out
192.168.0.117:49187 49187 65.54.87.90:80 TCP EST Out
192.168.0.117:49186 49186 65.54.87.185:80 TCP EST Out
192.168.0.117:49185 49185 65.54.87.90:80 TCP EST Out


norwegian
Premium
join:2005-02-15
Outback
Try netstat -ano
If no luck, try Wireshark

For reference though

quote:
[Querying whois.arin.net]
[whois.arin.net]
#
# Query terms are ambiguous. The query is assumed to be:
# "n 65.54.87.11"
#
# Use "?" to get help.
#

#
# The following results may also be obtained via:
# »whois.arin.net/rest/nets;q=65.54···=netref2
#

NetRange: 65.52.0.0 - 65.55.255.255
CIDR: 65.52.0.0/14
OriginAS:
NetName: MICROSOFT-1BLK
NetHandle: NET-65-52-0-0-1
Parent: NET-65-0-0-0-0
NetType: Direct Assignment
RegDate: 2001-02-14
Updated: 2012-03-20
Ref: »whois.arin.net/rest/net/NET-65-52-0-0-1

OrgName: Microsoft Corp
OrgId: MSFT
Address: One Microsoft Way
City: Redmond
StateProv: WA
PostalCode: 98052
Country: US
RegDate: 1998-07-10
Updated: 2011-04-26
Ref: »whois.arin.net/rest/org/MSFT


TheWiseGuy
Dog And Butterfly
Premium,MVM
join:2002-07-04
East Stroudsburg, PA
kudos:3
reply to Cartel
The most likely explanation is the program that established the connection has closed and is no longer using the port and the router is either not stateful or the proper TCP closing handshake did not occur so the router does not know the connection is no longer established.

This post may provide some links and background info to look at for a greater understanding.

»Re: D-Link 524 Router: Letting a few packets throu

--
Warning, If you post nonsense and use misinformation and are here to argue based on those methods, you will be put on ignore.


therube

join:2004-11-11
Randallstown, MD
reply to Cartel
Windows update perhaps?
So like windowsupdate.com or windowsupdate.microsoft.com.
(Though I was returned 65.55.25.* IP.)