too many listening ports...

hello people this is my first message,

Not sure if this has to do with internet security.. it has to do with my internet connections though and it's a big trouble at times. It happens when I "surf too much", opening alot of web pages at the same time. After opening a bunch I can't connect to anywhere else.. If I have an open connection to IRC for example, it may stay established, but I can't open any new connections and if I get disconnected from IRC for some reason I cannot reconnect :(

During this, if I check out my ports (using netstat or other software) I see that ALOT of ports are Listening, more than 150-200 ports listening :eek: ... I'm using dial-up, but even hanging-up doesn't solve the problem.. I have to reboot in order for things to turn back to normal.

Does anyone know what this may be caused from?? :confused:

see you around,
KoRR

hmm...why not check ur connection and ports at ....https://grc.com/x/ne.dll?bh0bkyd2 there u can see how ur ports are either open stealth or closed....check it out that way u can configure ur firewall better

Even when you disconnect? Thats weird...
Try http://www.blackcode.com 's port scan. Tell me the open ports and i'll see how I can help. Just copy and paste the scan results, and make them a text and put them up here.

Install a free firewall, like zonealarm, also check your antivirus updates and if you don't have one either get one or download a free trial.

Try Fport.exe from Foundstone (http://www.foundstone.com/knowledge/proddesc/fport.html)
It's a great tool that goes further than netstat: it shows open ports and the name, path and pid of the application that opened the port... Very usefull...

Ammo

look, I've been having this problem with and/or without a firewall. I'm always using Antivirus (Norton AV 2002, updated every time they have something new). I have no idea why I'm having this problem. The ports that are listening (whenever I have the problem) are starting from 10xx to some 11xx-12xx or so and 21xx to 22xx or so.. I don't remember exactly right now, If it happens again I'll write the ports range down.

I'm also using ZoneAlarm Pro 3 right now. I don't know all the options I should be using. I have completely blocked all NetBIOS stuff, as I had recently been hacked through port 139 because I was unaware of this huge security hole I was having (LAN in my house + unprotected shares with full access + NetBIOS via TCP/IP enabled which I hadn't noticed before)...

results of the GRC Shields UP:
-------------------------------------
Attempting connection to your computer. . .
Shields UP! is now attempting to contact the Hidden Internet Server within your PC. It is likely that no one has told you that your own personal computer may now be functioning as an Internet Server with neither your knowledge nor your permission. And that it may be serving up all or many of your personal files for reading, writing, modification and even deletion by anyone, anywhere, on the Internet!

Your Internet port 139 does not appear to exist!
...
Unable to connect with NetBIOS to your computer.
...

with the nanoprobe ports checking.. all the checked ports were in STEALTH mode.

I'm now waiting for the port scan on BLACKCODE to finish.. will post the results as soon as I have them.

Of course, when the problem happens there is no way to use these online scanners since it makes me unable to connect anywhere unless I reboot..

thanks for your feedback people :)
KoRR

The port scan on blackcode.com just finished.. all the ports where closed..

SCAN RESULTS:
Your system is secured. No open ports were found.


fport says that it supports Windows NT4, Windows 2000 and Windows XP
my OS is Windows ME.. so...

i know what you saying, how long does netstat show the connetion as still established after you've disconnected, web pages sometimes take a long time to time out but this shouldn't inhibit you from making another connection to irc after you disconnect.

unless its the way your firewall sets up rules, make sure it allows any local port to connect to remote 6667/6669 which ever you use. maybe its only allowing the local port you originally made the rule with to connect ?

...I fear it's started getting there...

now there are a few ports from 2446 to 2500 (not all of them) that are Waiting for Timeout and the foreign IP is the one of antionline.com, remote port: 80.. the rest of the ports in this range (which aren't waiting) are listening.......

for some reason, the number of listening ports is augmenting while I keep surfing now...

Again, this thing was happening even before I installed the firewall.. I have not set any permissions or restricted access to certain ports, besides the NetBIOS ports 137-139...

nice avatar there Tedob1 :) I used to be a MK fanatic!


edit1: the ports that were waiting for timeout are now LISTENing.. I have a huge range of listening ports from 2502 to 2646 ....... I will need rebooting in a while...

edit2: just after I edited the msg I was done of listening ports.. I disconnected manually from IRC just to see if I could reconnect there.. unable to resolve server.. Finally, all the ports in netstat were listening.. it was a range from 2500 to 2680 ... I rebooted and here I am again..

yeah id just use a port scanner of some sort to try and figure out which ones are opened and closed.