When I netstat.exe -ano and then netstat.exe -a this is what I see (edited slightly):

TCP sympatico:1025 LISTENING
TCP sympatico:1029 LISTENING
TCP sympatico:1047 LISTENING <-
TCP sympatico:137 LISTENING
TCP sympatico:138 LISTENING
TCP sympatico:nbsession LISTENING
TCP sympatico:1181 63.146.109.212:80 LISTENING <- Guessing this is IE open for this site?
UDP sympatico:1025
UDP sympatico:1029
UDP sympatico:1047 <-
UDP sympatico:nbname
UDP sympatico:nbdatagram

The suspicion I have here is on port 1047. just before doing this netstat, I found another "LISTENING" port on TCP 1029 (same positions in netstat list as 1047 is now, both TCP and UDP). I opened up my personal firewall and blocked TCP and UDP incoming/outgoing 1029. tested to see if I could use the net and it worked fine. now I see TCP and UDP 1047, which was never there. just like last night, when I blocked TCP and UDP incoming/outgoing 1039, and then 1029 suddenly appeared today. every time I block these ports I can still use the net fine (could be because they are opening different ports too ). I tried TCPView but it seems to be giving me the same thing as netstat.

also thought I'd note TCP and UDP ports 137, 138, 139 have been blocked for months now. was told by someone here (I think?) that these ports were being used for a spreading exploit at the time or something like that.

I am just wondering. does this appear to be normal behaviour? a port blocked simply opens another? would just like to hear you guys opinions on this. does this seem normal?

any help would be greatly appreciated.


- ryan