Printable View
I am running a program called Active Ports. When I connect to a site port 80 becomes very active with connections coming and going it seems to quiet down after a period of inactivity. When I go to your site 3-4 IPs showed up on port 80, is this normal? For example I was on blackcode.com (I think) and one was for 64.246.60.139. Even with no additional input from me this activity comes and goes (as I said it quiets down after awhile). It stops when I close the browser ( I had opened multiple).
That's because port 80 is the HTTP port. Used for browsing website's, etc. Is your program like a firewall? And when you browse website's, you send webserver's request's to view the content on that server. The server then send's a reply with the content, each time you view the website. That's why it's constantly going.
when you load a web page you also load the embedded links for ad servers third party advertisers and so on. banners get loaded from one server. flash from another etc. do a netstat to see all the sites involved.
if you want to really see some exceptional activity go to cnet or zdnet. they show just how far someone will go to give you an exceptional internet experiance </BS>
Therefore, there is nothing to worry about dazedand ;)
Port 80's the http port,and like Tedob1 said,banners ads etc sometimes load from third party servers..here's a list of a few common ports thought,if you're interested
Hi,
Even I don't see that there is a problem. How ver you can try this
close all the browser windows then try netstat -ano (if XP) then check whether there is any activity at port 80.
else if u have win 2k then try netstat -an and get process explorer from sysinternals ( Msmittens told me about this) and then check.
Also u might see that if there is no browser window open then u might still see activity on port 80 , this might be because some programs take long time to close or might be because of banners or ads.
Hope this helps.
MRG.
the only thing that'd be effective against is a program accessing a server that's had it's port 80 set to something else(since http is 80 by default,a browser HAS to be open right?)
Ok, if I'm getting the drift here as long as there is no port 80 activity when I am not on the net I'm OK? Opening IE and going on the net does not open port 80 in a way that it becomes suddenly vulnerable. All of the IP's that suddenly appear to be on port 80 when I go to a site can only be related to that site and not some kind of attack. What about questionable sites (I've ended up at some looking for trojan etc info) ie. what can these linked IP's that show up as connected to port 80 do, do they have any access to my machine or the data on it?
Since every connection you make on the net is based on reliability and trust,a user only goes to sites he trusts,for example,I could host a site with a million hostile scripts/trojans etc AND get away with it just cos YOU accessed my site..I never forced you to come there,so yes..if you're checking out sites like that,you can expect a trojan or two sooner or later,it tends to be sooner if they're sites by individual users
Quote:
I am running a program called Active Ports. When I connect to a site port 80 becomes very active with connections coming and going it seems to quiet down after a period of inactivity. When I go to your site 3-4 IPs showed up on port 80, is this normal? For example I was on blackcode.com (I think) and one was for 64.246.60.139. Even with no additional input from me this activity comes and goes (as I said it quiets down after awhile). It stops when I close the browser ( I had opened multiple).
You really don't need 3rd party software to monitor active ports/internet connections. Open MS-DOS or the Command prompt to obtain this information. Need help in either go to http://www.microsoft.com/resources/d...us/ntcmds.mspx
www.allcommands.com
http://www.computerhope.com/msdos.htm
BTW On that IP address check out samspade http://samspade.org/t/lookat?a=64.246.60.139 for info
As far as the issue at hand, maybe this will be some assistance. Taken from my PC.
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.
C:\Documents and Settings\greg>netstat -a -n -e -s -p TCP -r >tcp.txt
when done press enter it will go back to the prompt.
C:\Documents and Settings\greg>notepad tcp.txt (type whats in bold) press enter
to open the txt file and review what you see. Hope this helps, Computernerd22
make sure you keep up with all the latest patches, turn off things like activex and active scripting. if you do go to some questionable sites it would benifit you to set java scripting to prompt rather than just allow it. if your not patched then you may be owned.Quote:
Originally posted here by dazedand
Ok, if I'm getting the drift here as long as there is no port 80 activity when I am not on the net I'm OK? Opening IE and going on the net does not open port 80 in a way that it becomes suddenly vulnerable. All of the IP's that suddenly appear to be on port 80 when I go to a site can only be related to that site and not some kind of attack. What about questionable sites (I've ended up at some looking for trojan etc info) ie. what can these linked IP's that show up as connected to port 80 do, do they have any access to my machine or the data on it?