too many listening ports...

hello people this is my first message,

Not sure if this has to do with internet security.. it has to do with my internet connections though and it's a big trouble at times. It happens when I "surf too much", opening alot of web pages at the same time. After opening a bunch I can't connect to anywhere else.. If I have an open connection to IRC for example, it may stay established, but I can't open any new connections and if I get disconnected from IRC for some reason I cannot reconnect :(

During this, if I check out my ports (using netstat or other software) I see that ALOT of ports are Listening, more than 150-200 ports listening :eek: ... I'm using dial-up, but even hanging-up doesn't solve the problem.. I have to reboot in order for things to turn back to normal.

Does anyone know what this may be caused from?? :confused:

see you around,
KoRR

hmm...why not check ur connection and ports at ....https://grc.com/x/ne.dll?bh0bkyd2 there u can see how ur ports are either open stealth or closed....check it out that way u can configure ur firewall better

Even when you disconnect? Thats weird...
Try http://www.blackcode.com 's port scan. Tell me the open ports and i'll see how I can help. Just copy and paste the scan results, and make them a text and put them up here.

Install a free firewall, like zonealarm, also check your antivirus updates and if you don't have one either get one or download a free trial.

Try Fport.exe from Foundstone (http://www.foundstone.com/knowledge/proddesc/fport.html)
It's a great tool that goes further than netstat: it shows open ports and the name, path and pid of the application that opened the port... Very usefull...

Ammo

look, I've been having this problem with and/or without a firewall. I'm always using Antivirus (Norton AV 2002, updated every time they have something new). I have no idea why I'm having this problem. The ports that are listening (whenever I have the problem) are starting from 10xx to some 11xx-12xx or so and 21xx to 22xx or so.. I don't remember exactly right now, If it happens again I'll write the ports range down.

I'm also using ZoneAlarm Pro 3 right now. I don't know all the options I should be using. I have completely blocked all NetBIOS stuff, as I had recently been hacked through port 139 because I was unaware of this huge security hole I was having (LAN in my house + unprotected shares with full access + NetBIOS via TCP/IP enabled which I hadn't noticed before)...

results of the GRC Shields UP:
-------------------------------------
Attempting connection to your computer. . .
Shields UP! is now attempting to contact the Hidden Internet Server within your PC. It is likely that no one has told you that your own personal computer may now be functioning as an Internet Server with neither your knowledge nor your permission. And that it may be serving up all or many of your personal files for reading, writing, modification and even deletion by anyone, anywhere, on the Internet!

Your Internet port 139 does not appear to exist!
...
Unable to connect with NetBIOS to your computer.
...

with the nanoprobe ports checking.. all the checked ports were in STEALTH mode.

I'm now waiting for the port scan on BLACKCODE to finish.. will post the results as soon as I have them.

Of course, when the problem happens there is no way to use these online scanners since it makes me unable to connect anywhere unless I reboot..

thanks for your feedback people :)
KoRR

The port scan on blackcode.com just finished.. all the ports where closed..

SCAN RESULTS:
Your system is secured. No open ports were found.


fport says that it supports Windows NT4, Windows 2000 and Windows XP
my OS is Windows ME.. so...

i know what you saying, how long does netstat show the connetion as still established after you've disconnected, web pages sometimes take a long time to time out but this shouldn't inhibit you from making another connection to irc after you disconnect.

unless its the way your firewall sets up rules, make sure it allows any local port to connect to remote 6667/6669 which ever you use. maybe its only allowing the local port you originally made the rule with to connect ?

...I fear it's started getting there...

now there are a few ports from 2446 to 2500 (not all of them) that are Waiting for Timeout and the foreign IP is the one of antionline.com, remote port: 80.. the rest of the ports in this range (which aren't waiting) are listening.......

for some reason, the number of listening ports is augmenting while I keep surfing now...

Again, this thing was happening even before I installed the firewall.. I have not set any permissions or restricted access to certain ports, besides the NetBIOS ports 137-139...

nice avatar there Tedob1 :) I used to be a MK fanatic!


edit1: the ports that were waiting for timeout are now LISTENing.. I have a huge range of listening ports from 2502 to 2646 ....... I will need rebooting in a while...

edit2: just after I edited the msg I was done of listening ports.. I disconnected manually from IRC just to see if I could reconnect there.. unable to resolve server.. Finally, all the ports in netstat were listening.. it was a range from 2500 to 2680 ... I rebooted and here I am again..

yeah id just use a port scanner of some sort to try and figure out which ones are opened and closed.

mmm.. a new clue... checking back the DNS of those connections that are waiting for time out (many connections on ports from 1428 to 1582 right now, remote port:80) I see that it is from:

antionline.com and from ADS.antionline.com

while surfing around the site the number of connections (waiting for timeout) from this address is increasing.. after a while the ports may turn to listening status. It takes alot of time for a connection to timeout... is this something?

another notice is that I don't have this problem when I surf around sites which have no ads... could this be some kind of cookie problem?

By the way, I have ad-aware version 5, it shows that I'm clean of spyware right now..

Quote:

---

Originally posted here by KoRR
The port scan on blackcode.com just finished.. all the ports where closed..

SCAN RESULTS:
Your system is secured. No open ports were found.


fport says that it supports Windows NT4, Windows 2000 and Windows XP
my OS is Windows ME.. so...

---

Just to be safe with blackcode's port scan, proceed to phase 2, to make sure you have no trojan horses running, even though you have an antivirus, some trojans are stealth.

Dude, I'll say again, try Fport from Foundstone. (see my earlier post for url). At least with it you'll know what app is opening the ports.

Ammo

Oups, sorry didn'T see your post bout winME... Might still want to try it.. might work..

Ammo

its pretty normal for ports to listen for a while when a connection is no longer established, but it sounds like this goes far beyond that, plus your not being able to resolve a name. you might want to try uninstalling then re-installinf tcp/ip.
how do you connect, some dial up isps software, like netzero and aol can really mess up network settings.
i installed aol 7 on a machine at home and i couldn't get dns to work worth a ****. i tried everything until i finnaly disabled dns client in services, its worked great ever since...go figure.

Your suggestion seems to be working Tedob1 !! I uninstalled the TCP/IP, rebooted (got some blue screen there, probably because ZoneAlarm or Norton AV couldn't find the protocol needed), then re-installed TCP/IP for my Dial-up Adapter.

Things seem to be working fine now.. it's under test and I haven't faced the same problem since this re-installation. Crazy things.. the settings in TCP/IP are the same as before.. is there some hidden stuff that I can't see? Bad thing is I can't tell since WHEN I've been having this problem so I could find what caused it, and I've never seen this problem in another PC before. I keep telling that 'imagination is more important than knowledge and experience for a good troubleshooter'.. But this was beyond my imagination :D

In case it happens again I'll post again in this thread, but hopefully I won't need to! Thanks alot for your help! ;)

ironically... just after I posted my previous msg ... I saw some images couldn't load (squares with a red X appeared instead).. which is a bad omen... refreshing the page resulted on the infamous message of internet explorer.. so.. I rebooted and came back to report :(