dslreports logo
site
 
    All Forums Hot Topics Gallery
spc

spacer




how-to block ads


Search Topic:
uniqs
1657
share rss forum feed


Cartel
Premium
join:2006-09-13
Chilliwack, BC
kudos:2
Reviews:
·TekSavvy DSL
·Shaw
·TELUS

1 edit

Active Sessions / Internet Connections

Why do some connections stay EST even when that computer is turned off?

I see EST connections in the 6000-7000s range when the computer is not connected.

I can reproduce it, I can reboot the router and open IE and surf, close it and the EST connections should go to LA or TW but some just don't.

I can then shut off the computer, look from another computer and see the shut down computers IP still EST to a external IP.

It's driving me nut, I tried restoring defaults it does not help.

Why is this happening?


Cartel
Premium
join:2006-09-13
Chilliwack, BC
kudos:2
Reviews:
·TekSavvy DSL
·Shaw
·TELUS

Click for full size
Click for full size
Here is Currports showing the TIMEWAIT after I close FF in this example.
Then there or only listening system ports.

Then the router shows the still EST connections.

Is this nothing or am I seeing a problem here?


BimmerE38FN

join:2002-09-15
Boise, ID
kudos:1
reply to Cartel

Is there still power to the NIC on the PC? Some PCs, even if you shut them down, power still runs to the NIC. Try disconnecting the power cable or adapter from the wall out let and see what happens.



Cartel
Premium
join:2006-09-13
Chilliwack, BC
kudos:2
Reviews:
·TekSavvy DSL
·Shaw
·TELUS

said by BimmerE38FN:

Is there still power to the NIC on the PC? Some PCs, even if you shut them down, power still runs to the NIC. Try disconnecting the power cable or adapter from the wall out let and see what happens.

nope no power wol is disabled, no icon light on router.


BimmerE38FN

join:2002-09-15
Boise, ID
kudos:1
reply to Cartel

What model router is this?



Cartel
Premium
join:2006-09-13
Chilliwack, BC
kudos:2
reply to Cartel

dir655

This page

»support.dlink.com/Emulators/dir6···ons.html



BimmerE38FN

join:2002-09-15
Boise, ID
kudos:1
reply to Cartel

What HW rev is this router and what current FW is loaded?



Cartel
Premium
join:2006-09-13
Chilliwack, BC
kudos:2


Firmware Version: 1.35NA
Hardware Version: A4
Product Page: DIR-655



BimmerE38FN

join:2002-09-15
Boise, ID
kudos:1
reply to Cartel

You might call DLink support and ask for level 3 or higher support and see what they say and ask them if this is correct behavior or not.



DigitalXeron
There is a lack of sanity

join:2003-12-17
Hamilton, ON

1 recommendation

reply to Cartel

Session tables on routers are often not kept up to exact date with the state of the computer because the tables depend on packet transmits invoke a closing of connection or the like. If something (e.g. a firewall) interrupted such a transmission or wasn't sent at all, the connections can be left hanging for quite a while. Many NAT implementations have countdowns on sessions that have not transmitted or received data and will close the connection after a timeout is reached.

As far as TCP/6000-7000, That's normal browser activity, the computer locally will establish connections using a randomized port locally as so that multiple connections can be open at once to one or more webservers to download at once, otherwise, you couldn't browse more than one website at a time and page loading times would be much slower.
'
How long after browser activity stops is the above screenshots recorded?
--
--Kradorex Xeron
[an error occurred while processing this signature]



Cartel
Premium
join:2006-09-13
Chilliwack, BC
kudos:2
reply to Cartel

20 minutes.
It will stay there till it times out 130 minutes later.
It's not ALL connections, just some that I notice just hang there even though there is absolutely no connection to my browser at all.



Cartel
Premium
join:2006-09-13
Chilliwack, BC
kudos:2
reply to Cartel

maybe this is the problem?

TCP FIN WAIT Vulnerability - CVE-2013-0075

»technet.microsoft.com/en-us/secu···ms13-018



Cartel
Premium
join:2006-09-13
Chilliwack, BC
kudos:2
reply to Cartel

nope still does it after MS updates



Optimus2357
Premium
join:2010-11-21
West Warwick, RI
kudos:3

Its opening up HTTP sessions to the site, and then keeping them open for a length of time. This is normal. When you close the browser, the session shouldn't close, because the session isnt between the browser and the IP, but your computer and the IP. And even if you shut down the computer, the router will keep the connection open for a certain amount of time. That length of time is based on the traffic type. This is because of how TCP works. You should be able to see the session length (the 7642 number in pic) change if you F5 on the page.

Now if your saying your shutting down the computer that was browsing, and the session timer isn't changing with F5, I would say thats some kind of bug. Other then that, I really wouldn't worry about it.