This can't be good - Tilted Forum Project Discussion Community

MSD · 08-09-2004, 12:37 PM

Code:

Active Connections

C:\WINDOWS\Documents and Settings\Admin>netstat -n

  Proto  Local Address          Foreign Address        State
  TCP    192.168.2.67:1060      128.61.56.116:80       CLOSE_WAIT
  TCP    192.168.2.67:1061      67.107.201.9:80        CLOSE_WAIT
  TCP    192.168.2.67:1066      212.78.204.20:80       CLOSE_WAIT
  TCP    192.168.2.67:1068      128.148.26.122:80      CLOSE_WAIT
  TCP    192.168.2.67:1071      216.35.187.248:80      CLOSE_WAIT
  TCP    192.168.2.67:1073      62.99.138.242:80       CLOSE_WAIT
  TCP    192.168.2.67:1252      61.53.174.216:2500     LAST_ACK
  TCP    192.168.2.67:1270      80.125.78.102:10631    FIN_WAIT_2
  TCP    192.168.2.67:1373      217.121.195.145:16639  TIME_WAIT
  TCP    192.168.2.67:1379      192.168.2.135:139      TIME_WAIT
  TCP    192.168.2.67:1383      192.168.2.135:139      TIME_WAIT
  TCP    192.168.2.67:1385      80.222.83.99:6346      TIME_WAIT
  TCP    192.168.2.67:1389      24.2.82.15:6346        TIME_WAIT
  TCP    192.168.2.67:1390      217.122.118.100:6346   TIME_WAIT
  TCP    192.168.2.67:1391      217.121.195.145:16639  TIME_WAIT
  TCP    192.168.2.67:1393      213.93.210.218:38639   TIME_WAIT
  TCP    192.168.2.67:1398      82.254.16.127:15074    FIN_WAIT_1
  TCP    192.168.2.67:1399      80.61.118.98:14027     TIME_WAIT
  TCP    192.168.2.67:1420      24.186.140.69:8843     CLOSING
  TCP    192.168.2.67:1455      65.168.252.59:4278     ESTABLISHED
  TCP    192.168.2.67:1457      24.95.240.122:6346     TIME_WAIT
  TCP    192.168.2.67:1575      199.203.34.50:6346     TIME_WAIT
  TCP    192.168.2.67:1576      66.90.85.2:6346        TIME_WAIT
  TCP    192.168.2.67:1579      195.26.49.3:6346       ESTABLISHED
  TCP    192.168.2.67:1584      82.225.0.52:6346       TIME_WAIT
  TCP    192.168.2.67:1589      131.247.21.188:1557    ESTABLISHED
  TCP    192.168.2.67:1591      68.97.161.30:8040      TIME_WAIT
  TCP    192.168.2.67:1597      24.242.1.94:32118      TIME_WAIT
  TCP    192.168.2.67:1600      195.137.32.29:6346     TIME_WAIT
  TCP    192.168.2.67:1602      82.166.109.12:11630    TIME_WAIT
  TCP    192.168.2.67:1607      64.158.31.183:3523     TIME_WAIT
  TCP    192.168.2.67:1610      82.225.0.52:6346       TIME_WAIT
  TCP    192.168.2.67:1612      80.4.96.101:23423      FIN_WAIT_2
  TCP    192.168.2.67:1613      67.161.190.21:7623     TIME_WAIT
  TCP    192.168.2.67:1621      81.198.132.174:4661    FIN_WAIT_2
  TCP    192.168.2.67:1637      12.222.177.130:6346    TIME_WAIT
  TCP    192.168.2.67:1645      162.95.80.50:80        LAST_ACK
  TCP    192.168.2.67:1661      162.95.80.50:80        LAST_ACK
  TCP    192.168.2.67:1699      199.106.214.9:80       SYN_SENT
  TCP    192.168.2.67:1702      207.46.156.220:80      SYN_SENT
  TCP    192.168.2.67:1715      162.95.80.50:80        SYN_SENT
  TCP    192.168.2.67:1724      82.225.0.52:6346       SYN_SENT
  TCP    192.168.2.67:1725      212.129.202.210:6346   SYN_SENT
  TCP    192.168.2.67:1728      68.120.215.246:6346    SYN_SENT
  TCP    192.168.2.67:1729      80.202.201.13:6346     SYN_SENT
  TCP    192.168.2.67:1731      24.94.48.47:4206       SYN_SENT
  TCP    192.168.2.67:1732      80.111.45.57:40596     SYN_SENT
  TCP    192.168.2.67:1733      81.197.194.111:3015    SYN_SENT
  TCP    192.168.2.67:1734      192.168.2.135:139      TIME_WAIT
  TCP    192.168.2.67:1736      192.168.2.135:139      ESTABLISHED
  TCP    192.168.2.67:1737      24.218.25.46:6346      SYN_SENT
  TCP    192.168.2.67:1738      64.229.16.87:40755     SYN_SENT
  TCP    192.168.2.67:1739      211.29.172.216:6346    SYN_SENT
  TCP    192.168.2.67:1740      210.5.117.42:17430     SYN_SENT
  TCP    192.168.2.67:1741      195.137.32.29:6346     ESTABLISHED
  TCP    192.168.2.67:1743      217.88.134.156:6346    SYN_SENT
  TCP    192.168.2.67:1744      155.185.7.184:29013    SYN_SENT
  TCP    192.168.2.67:1745      69.29.96.137:12601     SYN_SENT
  TCP    192.168.2.67:1746      80.201.156.86:6346     SYN_SENT
  TCP    192.168.2.67:1747      82.65.80.44:26095      SYN_SENT
  TCP    192.168.2.67:1750      62.99.243.18:1102      SYN_SENT
  TCP    192.168.2.67:1751      81.15.226.6:23191      SYN_SENT
  TCP    192.168.2.67:1752      82.42.117.206:1082     SYN_SENT
  TCP    192.168.2.67:1753      69.143.170.118:6348    SYN_SENT

I'm going to go run virsusscan and Adaware/etc now.

Xirax · 08-09-2004, 12:47 PM

That's nasty...can we see an after shot?

I love my Linux:

Code:

xirax@gentoo xirax $ netstat -n
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State
tcp        0      0 142.177.243.146:33915   212.100.234.54:80       TIME_WAIT
tcp        0      0 142.177.243.146:33902   64.233.161.99:80        ESTABLISHED
tcp        0      0 142.177.243.146:33866   216.239.41.104:80       ESTABLISHED
tcp        0      0 142.177.243.146:32809   207.46.107.50:1863      ESTABLISHED
tcp        0      0 142.177.243.146:33912   216.92.204.203:80       TIME_WAIT
tcp        0      0 142.177.243.146:33911   66.218.70.70:80         ESTABLISHED
tcp        0      0 142.177.243.146:32807   205.188.1.222:5190      ESTABLISHED

And that's it. Omitting Active UNIX domain sockets of course...

Woody182 · 08-09-2004, 06:03 PM

how did you do this?? I mean show the open connections.

Xirax · 08-09-2004, 06:32 PM

Assuming you're using windows, then all you need to do is open up a command prompt (Start:Run:type 'cmd') and type 'netstat -n'

KMA-628 · 08-09-2004, 06:47 PM

What is the difference between "close wait" and "Time wait"?

How many of these is too many?

R3d · 08-09-2004, 07:05 PM

Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

Active Connections

Proto Local Address Foreign Address State
TCP 192.168.1.101:3013 207.46.106.190:1863 ESTABLISHED
TCP 192.168.1.101:3026 205.188.8.163:5190 ESTABLISHED
TCP 192.168.1.101:3034 205.188.1.24:5190 ESTABLISHED
TCP 192.168.1.101:3042 216.179.62.107:6667 ESTABLISHED

Xirax · 08-10-2004, 06:39 AM

As per here:

Quote:

TIME_WAIT—The socket is waiting after close to handle packets still in the network.
CLOSE_WAIT—The remote end has shut down, and it is waiting for the socket to close.

I don't think there's really a set number for 'too many'...by default, the timeout is rather high in most OS's, (20 to 30 secs)

MSD · 08-10-2004, 06:50 PM

I found the problem. After closing, Gnutella was still running as a process without any sign of it in the system tray or on the taskbar. I had connections to 192 hosts open.

08-09-2004, 06:03 PM	#3 (permalink)
Woody182 Crazy Location: Near Chicago, IL	how did you do this?? I mean show the open connections. __________________ If I fall in love, will you forgive me? If I lose my way, will you choose me? If I change my mind, will you change me? -Smashing Pumpkins

08-09-2004, 06:32 PM	#4 (permalink)
Xirax Psycho Location: Toronto	Assuming you're using windows, then all you need to do is open up a command prompt (Start:Run:type 'cmd') and type 'netstat -n' __________________ perl -e 'print $i=pack(c5,(41*2),sqrt(7056),(unpack(c,H)-2),oct(115),10);'

08-09-2004, 06:47 PM	#5 (permalink)
KMA-628 ....is off his meds...you were warned. Location: The Wild Wild West	What is the difference between "close wait" and "Time wait"? How many of these is too many? __________________ Before you criticize someone, you need to walk a mile in their shoes. That way, if they get angry at you.......you're a mile away.......and they're barefoot.

08-09-2004, 07:05 PM	#6 (permalink)
R3d Insane Location: Sask, Canada	Microsoft Windows XP [Version 5.1.2600] (C) Copyright 1985-2001 Microsoft Corp. Active Connections Proto Local Address Foreign Address State TCP 192.168.1.101:3013 207.46.106.190:1863 ESTABLISHED TCP 192.168.1.101:3026 205.188.8.163:5190 ESTABLISHED TCP 192.168.1.101:3034 205.188.1.24:5190 ESTABLISHED TCP 192.168.1.101:3042 216.179.62.107:6667 ESTABLISHED

08-10-2004, 06:50 PM	#8 (permalink)
MSD The sky calls to us ... Super Moderator Location: CT	I found the problem. After closing, Gnutella was still running as a process without any sign of it in the system tray or on the taskbar. I had connections to 192 hosts open.