I did track it down, with the aid of the logfile below.. I wrote a small
batch file to generate the logfile.. it runs NETSTAT -AN every 30
seconds. Batchfile is at end.
You can see from the logfile me first close Netscape, then reopen
it, it tries to connect to the Internet when I click on a bookmark and
opens a port. It then listens for HTTP traffic, presumably displaying
it in the instance associated with that port.
netstat displays ESTABLISHED state if there has been recent
traffic on the port.
Netscape does not release the port when you close the instance
(eg. window), only when all instances of Netscape are closed.
Until then, ports opened by Netscape assume LISTENING state.
The IP address displayed in 'foreign address' changes to whatever
website I am looking at.
The port numbers increment as instances are opened.
OK, so I peaked at my own web browser, but hey, I just found the
netstat -AN command, and I just learned a shitload more about
TCP/IP ;-)
I am planning a neato tool to run the netstat -AN command every
10 seconds on the computer I use to access the internet.. outputs
to HTML in a shared directory, which I can then click on from my
browser on my computer. Set to auto-refresh every 10 sec also.
And shazam, I can watch my internet traffic port-by-port!
Next question is, how do I tell which process is using what port?
logfile and script:
- 12 Oct 8:21:49 active connections:
Proto Local Address Foreign Address
State
TCP 0.0.0.0:1047 0.0.0.0:0
LISTENING
TCP 0.0.0.0:1048 0.0.0.0:0
LISTENING
TCP 0.0.0.0:1049 0.0.0.0:0
LISTENING
TCP 192.168.0.2:1047
208.48.102.136:80 CLOSE_WAIT
TCP 192.168.0.2:1048
208.48.102.136:80 CLOSE_WAIT
TCP 192.168.0.2:1049
208.48.102.136:80 CLOSE_WAIT
- 12 Oct 8:22:25 active connections:
Proto Local Address Foreign Address
State
- 12 Oct 8:23:00 active connections:
Proto Local Address Foreign Address
State
TCP 0.0.0.0:1053 0.0.0.0:0
LISTENING
TCP 0.0.0.0:1054 0.0.0.0:0
LISTENING
TCP 192.168.0.2:1054
216.200.119.23:80 SYN_SENT
UDP 0.0.0.0:1053 *:*
- 12 Oct 8:23:33 active connections:
Proto Local Address Foreign Address
State
TCP 0.0.0.0:1054 0.0.0.0:0
LISTENING
TCP 192.168.0.2:1054
216.200.119.23:80 SYN_SENT
- 12 Oct 8:24:07 active connections:
Proto Local Address Foreign Address
State
- 12 Oct 8:24:43 active connections:
Proto Local Address Foreign Address
State
- 12 Oct 8:25:18 active connections:
Proto Local Address Foreign Address
State
- 12 Oct 8:25:51 active connections:
Proto Local Address Foreign Address
State
TCP 0.0.0.0:1056 0.0.0.0:0
LISTENING
UDP 0.0.0.0:1056 *:*
- 12 Oct 8:26:28 active connections:
Proto Local Address Foreign Address
State
------------------------------------------
@echo off
set catchlog=c:\catch.log
set timeout=30
if not exist %catchlog% goto endlogtest
choice /N /T:N,3 * overwrite existing logfile
[%catchlog%] [N3] ?
if errorlevel 2 goto endlogtest
del %catchlog%
:endlogtest
echo. >> %catchlog%
stamp - active connections: >> %catchlog%
rem strip NetBIOS services and heading, append
rest to log
netstat -an | find /V "2:137" | find /V "2:138"
| find /V "2:139" | find /V "Active" >>
%catchlog%
choice /N /T:N,%timeout% - pausing for %timeout%
seconds (press Y to abort, N to force next scan)
:
if errorlevel = 2 catchit
:end
generated by msg2page 0.06 on Jul 21, 2006 at 19:05:06
search: