Robbert, Have you tried running this on another machine? I'm sure you'll find the exact same thing. When I run netstat like you did, I get something similar. The important point is the STATE of the connection. In your case, and mine, the STATE is "LISTENING". That doesn't mean that there's a connection..."ESTABLISHED" does. Regarding ports 1025-1028...those are documented by Microsoft as being used for RPC. If you're REALLY paranoid, run fport from Foundstone to see what's bound to those ports. --- Robbert Helling <robjehat_private> wrote: > If i look at my 2 first entries i see: > Active Connections > > Proto Local Address Foreign Address > State > TCP nack:epmap nack:0 > LISTENING > TCP nack:microsoft-ds nack:0 > LISTENING > > The Foreign Address shows my own host name, i'm not > sure why its listed > this way. But i guess you have to find your problem > locally. > > > At 18:59 5-3-2003, H C wrote: > >I'm not entirely sure what you mean by "foreign > >address listening to ports..."...netstat shows you > >what the local machine is listening on, and which > >endpoints the foreign addresses are connected to. > > > >Have you tried running Foundstone's fport yet? > > > > > > > > Running netstat -a , I found a foreign address > > > > "GirlNextDoor_" listening to ports TCP > 1025/1028. > > > > > > > > Can someone explain me what is going on this > > > desktop ? > > > > > > > > It's a Win2k/SP2 workstation with Mcafee > antivirus > > > and > > > > ZoneAlarm. > > > > > > > > Also, can you explain me the second set of > > > > connections, foreign address "*:*" ? > > > > > > > > Thanks for your help, > > > > Sal. > > > > > > > > > > > > >------------------------------------------------------- > > > > Microsoft Windows 2000 [Version 5.00.2195] > > > > (C) Copyright 1985-2000 Microsoft Corp. > > > > > > > > C:\>netstat -a > > > > > > > > Active Connections > > > > > > > > Proto Local Address Foreign > Address > > > > > > > State > > > > TCP p4win2k:epmap > Girlnextdoor_:0 > > > > > > > LISTENING > > > > TCP p4win2k:microsoft-ds > Girlnextdoor_:0 > > > > > > > LISTENING > > > > TCP p4win2k:1025 > Girlnextdoor_:0 > > > > > > > LISTENING > > > > TCP p4win2k:1028 > Girlnextdoor_:0 > > > > > > > LISTENING > > > > TCP p4win2k:netbios-ssn > Girlnextdoor_:0 > > > > > > > LISTENING > > > > UDP p4win2k:epmap *:* > > > > UDP p4win2k:microsoft-ds *:* > > > > UDP p4win2k:1027 *:* > > > > UDP p4win2k:1030 *:* > > > > UDP p4win2k:netbios-ns *:* > > > > UDP p4win2k:netbios-dgm *:* > > > > UDP p4win2k:isakmp *:* > > > > > > > > C:\> > > > > > > > > >------------------------------------------------------- > > > > > > > > > __________________________________________________ > > > > Do you Yahoo!? > > > > Yahoo! Tax Center - forms, calculators, tips, > more > > > > http://taxes.yahoo.com/ > > > > > > > > > > > > >---------------------------------------------------------------------------- > > > > > > > > <Pre>Lose another weekend managing your IDS? > > > > Take back your personal time. > > > > 15-day free trial of StillSecure Border > > > Guard.</Pre> > > > > <A > > > href="http://www.securityfocus.com/stillsecure"> > > > http://www.securityfocus.com/stillsecure </A> > > > > > > > -- > > > The Virgin BOFH... > > > Linux Registered User #288905 > > > Public GnuPG Key B760A432 available at > > > http://www.ines.ro/public_keys/jay.gpg > > > > > > > > ATTACHMENT part 2 application/pgp-signature > >name=signature.asc > > > > > > > >__________________________________________________ > >Do you Yahoo!? > >Yahoo! Tax Center - forms, calculators, tips, more > >http://taxes.yahoo.com/ > > > >---------------------------------------------------------------------------- > > > ><Pre>Lose another weekend managing your IDS? > >Take back your personal time. > >15-day free trial of StillSecure Border > Guard.</Pre> > ><A href="http://www.securityfocus.com/stillsecure"> > > >http://www.securityfocus.com/stillsecure </A> > > > ---------------------------------------------------------------------------- > > <Pre>Lose another weekend managing your IDS? > Take back your personal time. > 15-day free trial of StillSecure Border Guard.</Pre> > <A href="http://www.securityfocus.com/stillsecure"> > http://www.securityfocus.com/stillsecure </A> > > __________________________________________________ Do you Yahoo!? Yahoo! Tax Center - forms, calculators, tips, more http://taxes.yahoo.com/ ---------------------------------------------------------------------------- <Pre>Lose another weekend managing your IDS? Take back your personal time. 15-day free trial of StillSecure Border Guard.</Pre> <A href="http://www.securityfocus.com/stillsecure"> http://www.securityfocus.com/stillsecure </A>
This archive was generated by hypermail 2b30 : Fri Mar 07 2003 - 07:47:19 PST