Netsatat

Eamonn · Post by **Eamonn** » Wed Oct 12, 2005 6:26 pm

Just wondering if anybody knew why I seem to have an open connection to click-network.com (which seems to be a random cable TV company!)???

Can body think of a way of closing the connection?

Ta

Post by **fac51** » Wed Oct 12, 2005 6:57 pm

would have thought it would be to do with some running process you have going in the background

Post by **117** » Wed Oct 12, 2005 7:00 pm

prolly a route to whatever website you were browsing at the time, I just ran Netstat with firefox open and it came up with loads of stuff all related to the sites i had open at the time or the route to get there

Displays active TCP connections, ports on which the computer is listening, Ethernet statistics, the IP routing table, IPv4 statistics (for the IP, ICMP, TCP, and UDP protocols), and IPv6 statistics (for the IPv6, ICMPv6, TCP over IPv6, and UDP over IPv6 protocols). Used without parameters, netstat displays active TCP connections.

[url=http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/netstat.mspx[/url]

Post by **fac51** » Wed Oct 12, 2005 7:26 pm

but could be something else running in the background with an open connection rather than a website being browsed.

Eamonn · Post by **Eamonn** » Wed Oct 12, 2005 8:09 pm

have closed all internet related apps and the bastid's still coming up! it looks like some sort of adware imo

Post by **fac51** » Wed Oct 12, 2005 8:37 pm

agreed

vinnieza · Post by **vinnieza** » Thu Oct 13, 2005 7:57 am

i thought if it was a site you just visited it says http as the port or 8080 while that says port 4931. Also, if you're nopt on it anymore it says time_wait or closed?

I think it's what edd said, a background program, unless it's somthing to do with NTL if you have NTL?

But i no nothing about these things so i maybe wrong

Vlammetje · Post by **Vlammetje** » Thu Oct 13, 2005 8:24 am

i wasn't aware NTL operated in UAE as well??

does adaware nto pick ity up? can you close the port at all?

Eamonn · Post by **Eamonn** » Thu Oct 13, 2005 9:15 am

nope NTL does indeed not operate in the UAE!

Have done an ad-aware scan, and also a spybot scan but no luck!

Eamonn · Post by **Eamonn** » Thu Oct 13, 2005 9:23 am

now its changed into 01060011091acf47.cg.shawcable.net:2581, which seems to be another cable/telephone company!

Post by **fac51** » Thu Oct 13, 2005 1:03 pm

i would burn your pc

wonder if its a connection incoming from an attacker using different hacked pc's? paranoia maybe

could try using ethereal to monitor the connection and see what packets of dtaa are being exchanged. its a bit tricky to use but it may help.

http://www.ethereal.com/

its a great proggy and can easily scare you as you see all your plain text passwords whizz by.

Eamonn · Post by **Eamonn** » Thu Oct 13, 2005 2:52 pm

downloading it now...

Eamonn · Post by **Eamonn** » Thu Oct 13, 2005 3:39 pm

rittte wtf is one supposed to do with this proggy!

Post by **fac51** » Thu Oct 13, 2005 5:49 pm

read the helpfile mate, its complicated to say the least but you set it to monitor your ethernet port and it will show all data packets incoming and outgoing.

you can open those packets and see all the data that gets transfered over the net, this is the reason its so frightenening when you see your passwords whizz by and realise how easy they would be to intercept and read :/

anyway maybe you would be able to see the packets of data that are heading to the ip address your concerned about?

vinnieza · Post by **vinnieza** » Fri Oct 14, 2005 7:57 am

You could always also try asking the people at hackthissite.org as they're pretty good with comp. stuff.