Net activity when not browsing or downloading

radiospan

Hi,

I have not been downloading or browsing much today, but I've left my Clicksilver connection active.

I noticed the dialup status lights in the taskbar flashing, so I ran "netstat 5" from the command prompt.

I found a few active connections, including:

irc.wh.verio.net:1865 time_wait
irc.wh.verio.net:1926 time_wait
205.164.141.35:2426 syn_sent
216.32.207.207:6667 established

The addresses change every so often, and according to DUMeter the speed of whatever this traffic is never goes much higher than 0.2kB/sec.

I had all messanging programs closed.

Does anyone know what connections these are?

When the rest of you are not using the internet, do ye disconnect or leave the connection on?

Thanks.

Gummy Panda

Put a firewall on. I have had attacks on my PC when not using the net. One was even by IOL (lol, my provider).

Better safe then sorry

B0rG

type
netstat -a
it will show all open ports that your machine is listenin to. Also try security board for advice on windows net security.

TIME_WAIT afaik means that connection is actually closed but the socket stays open yet for a while longer.

The basic way hackers (well, not really real hackers - boyscouts) work - they scan large segments of the network to see what's in there. If they find a certain os they try its various ports to see how they respond. Since your machine will be listening to certain open ports there is a potential vulnerability.

radiospan

I've switched on the Windows XP Firewall. I don't know if that's good enough or not.

If it is just "boyscouts", I can understand how some of the addresses are just IP's., but I'm surprised that many of them seem to be from irc networks. Just now there is irc.weblook2k.com:6667, and there was a Swedish irc one a few minutes ago.

I'll try the security board anyway, thanks for your help.

fatguy

There are several irc worms floating around that infect servers and search for other servers to infect.

Michael Collins

I've switched on the Windows XP Firewall. I don't know if that's good enough or not

I've heard bad reports about the Windows XP Firewall. It can cause horrible problems if you use a network and generally isn't a great firewall.

You should try out ZoneAlarm they have a free version for download.

Richard Dower

Originally posted by Michael Collins
I've heard bad reports about the Windows XP Firewall. It can cause horrible problems if you use a network and generally isn't a great firewall.

You should try out ZoneAlarm they have a free version for download.

I also have the Windows XP Pro firewalls enabled + Norton Internet Security 2003, includes antivirus. So don't even try to hack me!!

fatguy

Sounds like a challenge...

:ninja:

Gummy Panda

Fatguy,

Richard is abit of a sap, so don't mind him.

Richard Dower

Originally posted by clownboy
Fatguy,

Richard is abit of a sap, so don't mind him.

Report to moderator.

Mutant_Fruit

i recommend Kerio Personal Firewall for a great FREE! firewall program.

And a point to note, not all the incomings from unknown sources are "hacks" it oculd be someone who mistyped an IP...

Gummy Panda

I recommend Norton Firewall. It can traced the attack to its user and idenitfly them.

Not cheap though compared to freeware like zonealarm