port 80 activity
Page 1 of 2 12 LastLast
Results 1 to 10 of 11

Thread: port 80 activity

  1. #1
    Junior Member
    Join Date
    May 2004
    Posts
    11

    Angry port 80 activity

    I am running a program called Active Ports. When I connect to a site port 80 becomes very active with connections coming and going it seems to quiet down after a period of inactivity. When I go to your site 3-4 IPs showed up on port 80, is this normal? For example I was on blackcode.com (I think) and one was for 64.246.60.139. Even with no additional input from me this activity comes and goes (as I said it quiets down after awhile). It stops when I close the browser ( I had opened multiple).

  2. #2
    King Arana: Super Moderator
    Join Date
    Oct 2002
    Posts
    4,055
    That's because port 80 is the HTTP port. Used for browsing website's, etc. Is your program like a firewall? And when you browse website's, you send webserver's request's to view the content on that server. The server then send's a reply with the content, each time you view the website. That's why it's constantly going.
    Space For Rent.. =]

  3. #3
    Senior Member
    Join Date
    Nov 2001
    Posts
    4,786
    when you load a web page you also load the embedded links for ad servers third party advertisers and so on. banners get loaded from one server. flash from another etc. do a netstat to see all the sites involved.

    if you want to really see some exceptional activity go to cnet or zdnet. they show just how far someone will go to give you an exceptional internet experiance </BS>
    Bukhari:V3B48N826 “The Prophet said, ‘Isn’t the witness of a woman equal to half of that of a man?’ The women said, ‘Yes.’ He said, ‘This is because of the deficiency of a woman’s mind.’”

  4. #4
    AFLAAACKKK!!
    Join Date
    Apr 2004
    Posts
    1,065
    Therefore, there is nothing to worry about dazedand
    I am the uber duck!!1
    Proxy Tools

  5. #5
    Senior Member therenegade's Avatar
    Join Date
    Apr 2003
    Posts
    400
    Port 80's the http port,and like Tedob1 said,banners ads etc sometimes load from third party servers..here's a list of a few common ports thought,if you're interested

  6. #6
    Senior Member
    Join Date
    Mar 2004
    Posts
    113
    Hi,

    Even I don't see that there is a problem. How ver you can try this

    close all the browser windows then try netstat -ano (if XP) then check whether there is any activity at port 80.

    else if u have win 2k then try netstat -an and get process explorer from sysinternals ( Msmittens told me about this) and then check.

    Also u might see that if there is no browser window open then u might still see activity on port 80 , this might be because some programs take long time to close or might be because of banners or ads.

    Hope this helps.

    MRG.

  7. #7
    Senior Member therenegade's Avatar
    Join Date
    Apr 2003
    Posts
    400
    the only thing that'd be effective against is a program accessing a server that's had it's port 80 set to something else(since http is 80 by default,a browser HAS to be open right?)

  8. #8
    Junior Member
    Join Date
    May 2004
    Posts
    11
    Ok, if I'm getting the drift here as long as there is no port 80 activity when I am not on the net I'm OK? Opening IE and going on the net does not open port 80 in a way that it becomes suddenly vulnerable. All of the IP's that suddenly appear to be on port 80 when I go to a site can only be related to that site and not some kind of attack. What about questionable sites (I've ended up at some looking for trojan etc info) ie. what can these linked IP's that show up as connected to port 80 do, do they have any access to my machine or the data on it?

  9. #9
    Senior Member therenegade's Avatar
    Join Date
    Apr 2003
    Posts
    400
    Since every connection you make on the net is based on reliability and trust,a user only goes to sites he trusts,for example,I could host a site with a million hostile scripts/trojans etc AND get away with it just cos YOU accessed my site..I never forced you to come there,so yes..if you're checking out sites like that,you can expect a trojan or two sooner or later,it tends to be sooner if they're sites by individual users

  10. #10
    AO's MMA Fanatic! Computernerd22's Avatar
    Join Date
    Mar 2003
    Location
    Miami, FL
    Posts
    765
    I am running a program called Active Ports. When I connect to a site port 80 becomes very active with connections coming and going it seems to quiet down after a period of inactivity. When I go to your site 3-4 IPs showed up on port 80, is this normal? For example I was on blackcode.com (I think) and one was for 64.246.60.139. Even with no additional input from me this activity comes and goes (as I said it quiets down after awhile). It stops when I close the browser ( I had opened multiple).

    You really don't need 3rd party software to monitor active ports/internet connections. Open MS-DOS or the Command prompt to obtain this information. Need help in either go to http://www.microsoft.com/resources/d...us/ntcmds.mspx

    www.allcommands.com
    http://www.computerhope.com/msdos.htm

    BTW On that IP address check out samspade http://samspade.org/t/lookat?a=64.246.60.139 for info

    As far as the issue at hand, maybe this will be some assistance. Taken from my PC.


    Microsoft Windows XP [Version 5.1.2600]
    (C) Copyright 1985-2001 Microsoft Corp.

    C:\Documents and Settings\greg>netstat -a -n -e -s -p TCP -r >tcp.txt

    when done press enter it will go back to the prompt.

    C:\Documents and Settings\greg>notepad tcp.txt (type whats in bold) press enter

    to open the txt file and review what you see. Hope this helps, Computernerd22

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

 Security News

     Patches

       Security Trends

         How-To

           Buying Guides