Results 1 to 8 of 8

Thread: Close_wait?????

  1. #1
    Junior Member
    Join Date
    Nov 2002


    every time when i go to command prompt and type in "netstat" i get this .....

    Proto Local Address Foreign Address State
    TCP mycomputer unknown.level3.net:http CLOSE_WAIT

    the foreign address is using port 80...wait here is what i get when i type in "netstat -n"....

    Proto Local Address Foreign Address State
    TCP xxxxxxxxxxx:1028 CLOSE_WAIT

    I actually checked out unknown.level3.net and it was a like an ISP website, but why do i always get their address even when i restart the computer or when i'm not opening any Internet windows. (I'm using road runner btw).

    Can someone give me a explanation of why this is happening?


  2. #2
    Senior Member
    Join Date
    Sep 2001

    perhaps it is because of adware?

    have you installed any shareware or supposed freeware lately?

    perhaps you have one which is set to start up when windows does, and the adware side tries to get to that website.

    \'hi, welcome to *****. if you would like to speak to an operator, please hang up now.\'
    * click *

  3. #3
    Senior Member
    Join Date
    Jul 2001
    I use to socket programming but its been awhile so I did some research on the state CLOSE_WAIT and came up with:
    Sockets stay in CLOSE_WAIT forever on Win 95/98/Me due to the bug http://support.microsoft.com/default...EN-US;q229658/
    from http://www.cygwin.com/ml/cygwin-patc.../msg00039.html -if your not developing this not a solution but I thought you might find it useful.

    If you spend more on coffee than on IT security, you will be hacked. What\'s more, you deserve to be hacked.
    -- former White House cybersecurity adviser Richard Clarke

  4. #4
    Senior Member
    Join Date
    Aug 2002
    Try using something like TCP View to track the connection in real-time. This way, you will be able to see what application may be initiating the connection. I hope that helps you at least a little. Take care. Let us know if you need any additional help.

    Opinions are like holes - everybody\'s got\'em.


  5. #5
    Member GandalfTheGray's Avatar
    Join Date
    Jan 2003
    If you haven't done so, you might download and install some free software to help harden your system. There are many programs to choose from but here are a few:

    Ad Aware www.lavasoftusa.com/ -- scans for adware and removes it
    ZoneAlarm www.zonelabs.com/store/content/home.jsp -- free firewall for personal use
    Antivirus www.grisoft.com

  6. #6
    Join Date
    Jan 2002
    Run Fport from www.foundstone.com - you will be able to tell if the app using the connection is one you expect...

    .....Brain Failure....dumping core.... z z z

  7. #7
    Junior Member
    Join Date
    Nov 2002
    thanks guys.

    actually i've never installed any freeware nor shareware, but maybe it is an ad.

    when i get home from work today, i will try all the suggestions voiced. I will let you know what happens.

    thanks for the help.

  8. #8
    Senior Member
    Join Date
    Apr 2002
    CLOSE_WAIT means you have been connected to a remote host and it has been given the kill signal and it is waiting to close the connection
    by the looks of it it has been a webserver you have been conected to

    TCP xxxxxxxxxxx:1028
    the xxxxxxx being you're ipaddress the 1028 being the port that has sent the siganl to the webserver is the address of the webserver and the port you have been connected to ie the http port so this leads me to belive it is a webserver there doesent seem to be a whois entry on this address though it shouldnt be anything to worry about though
    try running ad-aware just in case
    By the sacred **** of the sacred psychedelic tibetan yeti ....We\'ll smoke the chinese out
    The 20th century pharoes have the slaves demanding work

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts