Printable View
C:\>netstat
Active Connections
Proto Local Address Foreign Address State
TCP server:3036 ##.###.###.###:http TIME_WAIT
TCP server:#### ##-###-##-##.client.attbi.com:#### ESTABLISHED
TCP server:4838 dialup-67.75.152.22.Dial1.Atlanta1.Level3.net:12
14 FIN_WAIT_1
C:\>
Do you see where it says dialup-67.75.152.22.Dial1.Atlanta1.Level3.net:12
Im curious what that is? Any suggestions
My guess is thats your ISP that your computer is dialing to through port 4838
r you surfing a site ....maybe that the server of the site ..or hmmm ... what ISP are you using ... maybe that the ISP server or dialup location .... it could also be a remote connection .... why dont u close it and see what happens :)
if your on dialup it may be the modem on the other end yes, but most likely it's a connection for a file sharing util like gnutella/kazaa/etc it could be ICQ as well (though chat client connections are usually quick and dont hang out long)
kill off your file sharing and any chat clients and check it again.... that'll letcha know
It would be a safe bet to say that it is your ISP host, or the computer that you dialed into. -Twisted-
67.75.152.22 is a dial up accoumt:
22.152.75.67.in-addr.arpa PTR (Pointer) dialup-67.75.152.22.Dial1.Atlanta1.Level3.net
Pointers are usually assigned dynamically at login time.
port 4838 is registered as varadero-1 (whatever in hell that is) but because it is registered i doubt it would be used by a commercial file sharing network. Although i could be totally off the wall here.
i suggest you go to this link at foundstond.com and download fport:
http://www.foundstone.com/index.htm?...desc/fport.htm
Put it in your search path (c:\windows\ or c:\\winnt\) open a dos prompt and enter fport. it will map the open ports to the program thats using it.
Let us know what you find
Wow great reply answer Tedob1. Must of really thought about that one. -Twisted-
Notice the format
'Proto' 'Local Address' 'Foreign Address' 'State'
'TCP' 'server:4838 'dialup-67.75.152.22.Dial1.Atlanta1.Level3.net:1214' 'FIN_WAIT_1'
Interesting that the machine you run netstat on is logged on as (named) "server".
What this says is 'dialup-67-etc' connected to 'server' (your machine) on port:4838.
State FIN_WAIT_1 indicates that the dialup client initiated a disconnect however the
server application on your machine has yet to acknowledge the disconnect.
Not much else to be said without knowing what software on your machine was listening
on that port.
The weird bit is the fact that your machine is conected to this other box (which looks like your ISP machine for handling modem connections) on port 12. Port 12 is a low port AND it's not assigned. This could indicate that the remote server is running some sort of non standard monitoring/authenticating for dailin users. It's hard to say without doing some more digging around. Try telneting to that machine on port 12 and see if you get a banner back in the response that gives you a clue.Quote:
TCP server:4838 dialup-67.75.152.22.Dial1.Atlanta1.Level3.net:12
Which simply means that this is someone you were connected to with Kazaa (port 1214). my_wan explained what FIN_WAIT_1 means (understandable considering the context of a p2p program). If you close Kazaa, and then do a netstat, you should see a bunch of entries in the list with FIN_WAIT_1.Quote:
TCP server:4838 dialup-67.75.152.22.Dial1.Atlanta1.Level3.net:1214 FIN_WAIT_1