Forum Home
Press F1
 
Thread ID: 42824 2004-02-23 13:56:00 Netstat info flying_green_leprachaun (1767) Press F1
Post ID Timestamp Content User
217655 2004-02-23 13:56:00 Proto Local Address Foreign Address State
TCP the-machine:4664 localhost:4665 ESTABLISHED
TCP the-machine:4665 localhost:4664 ESTABLISHED

this is a copy of a portion of a netstat log.

what might it mean that the local address is connecting to localhost like this?
flying_green_leprachaun (1767)
217656 2004-02-24 01:28:00 What you are seeing is one process communicating with another using TCP.

This is not uncommon, one example is Internet Explorer, it will establixh local connections to communicate with the spyglass rendering engine, or your email client connecting with an antivirus email proxy.
ugh1 (4204)
217657 2004-02-24 02:11:00 AH! so much more sense to me now .

Now I just want to find out what they were . . . .

/Thanks
flying_green_leprachaun (1767)
217658 2004-02-24 03:25:00 to find out what process they belong to use the -o switch
eg netstat -o

This will give you the process id number. Now press Ctrl Shift Esc to open the task manager. Simply match up the PID from netstat to the image name in the task manager to find out what they are. If you dont see a PID column (you should be looking under the processes tab) then click on view select columns and add PID.
Alternatively you can download fport which matches ports to apps in the command window.
B.
Barnabas (4562)
217659 2004-02-24 09:38:00 thats bloody handy,

thanks Barnabas.
flying_green_leprachaun (1767)
217660 2004-02-24 09:40:00 Proto Local Address Foreign Address State PID
TCP the-machine:3316 localhost:3317 ESTABLISHED 440
TCP the-machine:3317 localhost:3316 ESTABLISHED 440

turns out its firefox.
flying_green_leprachaun (1767)
1