Tilted Forum Project Discussion Community

Tilted Forum Project Discussion Community (https://thetfp.com/tfp/)
-   Tilted Technology (https://thetfp.com/tfp/tilted-technology/)
-   -   This can't be good (https://thetfp.com/tfp/tilted-technology/65348-cant-good.html)

MSD 08-09-2004 12:37 PM
This can't be good
 
Code:
Active Connections

C:\WINDOWS\Documents and Settings\Admin>netstat -n

  Proto  Local Address          Foreign Address        State
  TCP    192.168.2.67:1060      128.61.56.116:80      CLOSE_WAIT
  TCP    192.168.2.67:1061      67.107.201.9:80        CLOSE_WAIT
  TCP    192.168.2.67:1066      212.78.204.20:80      CLOSE_WAIT
  TCP    192.168.2.67:1068      128.148.26.122:80      CLOSE_WAIT
  TCP    192.168.2.67:1071      216.35.187.248:80      CLOSE_WAIT
  TCP    192.168.2.67:1073      62.99.138.242:80      CLOSE_WAIT
  TCP    192.168.2.67:1252      61.53.174.216:2500    LAST_ACK
  TCP    192.168.2.67:1270      80.125.78.102:10631    FIN_WAIT_2
  TCP    192.168.2.67:1373      217.121.195.145:16639  TIME_WAIT
  TCP    192.168.2.67:1379      192.168.2.135:139      TIME_WAIT
  TCP    192.168.2.67:1383      192.168.2.135:139      TIME_WAIT
  TCP    192.168.2.67:1385      80.222.83.99:6346      TIME_WAIT
  TCP    192.168.2.67:1389      24.2.82.15:6346        TIME_WAIT
  TCP    192.168.2.67:1390      217.122.118.100:6346  TIME_WAIT
  TCP    192.168.2.67:1391      217.121.195.145:16639  TIME_WAIT
  TCP    192.168.2.67:1393      213.93.210.218:38639  TIME_WAIT
  TCP    192.168.2.67:1398      82.254.16.127:15074    FIN_WAIT_1
  TCP    192.168.2.67:1399      80.61.118.98:14027    TIME_WAIT
  TCP    192.168.2.67:1420      24.186.140.69:8843    CLOSING
  TCP    192.168.2.67:1455      65.168.252.59:4278    ESTABLISHED
  TCP    192.168.2.67:1457      24.95.240.122:6346    TIME_WAIT
  TCP    192.168.2.67:1575      199.203.34.50:6346    TIME_WAIT
  TCP    192.168.2.67:1576      66.90.85.2:6346        TIME_WAIT
  TCP    192.168.2.67:1579      195.26.49.3:6346      ESTABLISHED
  TCP    192.168.2.67:1584      82.225.0.52:6346      TIME_WAIT
  TCP    192.168.2.67:1589      131.247.21.188:1557    ESTABLISHED
  TCP    192.168.2.67:1591      68.97.161.30:8040      TIME_WAIT
  TCP    192.168.2.67:1597      24.242.1.94:32118      TIME_WAIT
  TCP    192.168.2.67:1600      195.137.32.29:6346    TIME_WAIT
  TCP    192.168.2.67:1602      82.166.109.12:11630    TIME_WAIT
  TCP    192.168.2.67:1607      64.158.31.183:3523    TIME_WAIT
  TCP    192.168.2.67:1610      82.225.0.52:6346      TIME_WAIT
  TCP    192.168.2.67:1612      80.4.96.101:23423      FIN_WAIT_2
  TCP    192.168.2.67:1613      67.161.190.21:7623    TIME_WAIT
  TCP    192.168.2.67:1621      81.198.132.174:4661    FIN_WAIT_2
  TCP    192.168.2.67:1637      12.222.177.130:6346    TIME_WAIT
  TCP    192.168.2.67:1645      162.95.80.50:80        LAST_ACK
  TCP    192.168.2.67:1661      162.95.80.50:80        LAST_ACK
  TCP    192.168.2.67:1699      199.106.214.9:80      SYN_SENT
  TCP    192.168.2.67:1702      207.46.156.220:80      SYN_SENT
  TCP    192.168.2.67:1715      162.95.80.50:80        SYN_SENT
  TCP    192.168.2.67:1724      82.225.0.52:6346      SYN_SENT
  TCP    192.168.2.67:1725      212.129.202.210:6346  SYN_SENT
  TCP    192.168.2.67:1728      68.120.215.246:6346    SYN_SENT
  TCP    192.168.2.67:1729      80.202.201.13:6346    SYN_SENT
  TCP    192.168.2.67:1731      24.94.48.47:4206      SYN_SENT
  TCP    192.168.2.67:1732      80.111.45.57:40596    SYN_SENT
  TCP    192.168.2.67:1733      81.197.194.111:3015    SYN_SENT
  TCP    192.168.2.67:1734      192.168.2.135:139      TIME_WAIT
  TCP    192.168.2.67:1736      192.168.2.135:139      ESTABLISHED
  TCP    192.168.2.67:1737      24.218.25.46:6346      SYN_SENT
  TCP    192.168.2.67:1738      64.229.16.87:40755    SYN_SENT
  TCP    192.168.2.67:1739      211.29.172.216:6346    SYN_SENT
  TCP    192.168.2.67:1740      210.5.117.42:17430    SYN_SENT
  TCP    192.168.2.67:1741      195.137.32.29:6346    ESTABLISHED
  TCP    192.168.2.67:1743      217.88.134.156:6346    SYN_SENT
  TCP    192.168.2.67:1744      155.185.7.184:29013    SYN_SENT
  TCP    192.168.2.67:1745      69.29.96.137:12601    SYN_SENT
  TCP    192.168.2.67:1746      80.201.156.86:6346    SYN_SENT
  TCP    192.168.2.67:1747      82.65.80.44:26095      SYN_SENT
  TCP    192.168.2.67:1750      62.99.243.18:1102      SYN_SENT
  TCP    192.168.2.67:1751      81.15.226.6:23191      SYN_SENT
  TCP    192.168.2.67:1752      82.42.117.206:1082    SYN_SENT
  TCP    192.168.2.67:1753      69.143.170.118:6348    SYN_SENT
I'm going to go run virsusscan and Adaware/etc now.

Xirax 08-09-2004 12:47 PM
That's nasty...can we see an after shot?

I love my Linux:
Code:
xirax@gentoo xirax $ netstat -n
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address          Foreign Address        State
tcp        0      0 142.177.243.146:33915  212.100.234.54:80      TIME_WAIT
tcp        0      0 142.177.243.146:33902  64.233.161.99:80        ESTABLISHED
tcp        0      0 142.177.243.146:33866  216.239.41.104:80      ESTABLISHED
tcp        0      0 142.177.243.146:32809  207.46.107.50:1863      ESTABLISHED
tcp        0      0 142.177.243.146:33912  216.92.204.203:80      TIME_WAIT
tcp        0      0 142.177.243.146:33911  66.218.70.70:80        ESTABLISHED
tcp        0      0 142.177.243.146:32807  205.188.1.222:5190      ESTABLISHED
And that's it. Omitting Active UNIX domain sockets of course...

Woody182 08-09-2004 06:03 PM
how did you do this?? I mean show the open connections.

Xirax 08-09-2004 06:32 PM
Assuming you're using windows, then all you need to do is open up a command prompt (Start:Run:type 'cmd') and type 'netstat -n'

KMA-628 08-09-2004 06:47 PM
What is the difference between "close wait" and "Time wait"?

How many of these is too many?

R3d 08-09-2004 07:05 PM
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

Active Connections

Proto Local Address Foreign Address State
TCP 192.168.1.101:3013 207.46.106.190:1863 ESTABLISHED
TCP 192.168.1.101:3026 205.188.8.163:5190 ESTABLISHED
TCP 192.168.1.101:3034 205.188.1.24:5190 ESTABLISHED
TCP 192.168.1.101:3042 216.179.62.107:6667 ESTABLISHED

Xirax 08-10-2004 06:39 AM
As per here:

Quote:
TIME_WAIT—The socket is waiting after close to handle packets still in the network.
CLOSE_WAIT—The remote end has shut down, and it is waiting for the socket to close.
I don't think there's really a set number for 'too many'...by default, the timeout is rather high in most OS's, (20 to 30 secs)

MSD 08-10-2004 06:50 PM
I found the problem. After closing, Gnutella was still running as a process without any sign of it in the system tray or on the taskbar. I had connections to 192 hosts open.


All times are GMT -8. The time now is 11:13 PM.

Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2026, vBulletin Solutions, Inc.
Search Engine Optimization by vBSEO 3.6.0 PL2
© 2002-2012 Tilted Forum Project


1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73