Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 4 down vote favorite
2

I ran netstat -a under windows.

what is the meaning of this line UDP [::]:57427 *:* ?

Proto  Local Address          Foreign Address        State
UDP    [::]:5355              *:*
UDP    [::]:57427             *:*
UDP    [::1]:5353             *:*

I wonder if one of those is a backdoor to my machine?

share|improve this question
The relevance to the IT Security Stack Exchange is not obvious to me and not explained in the question. Generally speaking, specific questions about "how do I use a particular piece of system administration software" often not an ideal fit for this site; you might need to read the documentation or contact a support forum for that software. – D.W. Apr 14 '12 at 0:47

3 Answers

up vote 4 down vote accepted

Break down:

Your computer is listening on UDP ports 5355, 57427, 5353 and accepting communications from any foreign address.

5355 and 5353 might be DNScache
57427 might be FDResPub, which is a Windows OS DLL, that advertises the computer and its resources to the network.

Running:

netstat -a -p UDP -b

can be helpful in determining what is attached to those ports.


[::] and [::1]

If you run 

netstat -a -p UDP

you will see that the [::] lines are equivalent to "0.0.0.0", which means that these ports are bound to any local IP address. [::1] lines are equivalent to 127.0.0.1, which is the local host.

share|improve this answer
Well then, the machine is not accepting communication from any foreign address on port 5353. That is, it would accept it, as long as the foreign address can be routed to the local "localhost", which more or less means that the "foreign address" is not very foreign at all. – Thomas Pornin Apr 24 at 19:40
up vote 1 down vote

You may run netstat -an -p udp -o to identify the PID of the process owning port 57427. It may be Pando Media Booster

share|improve this answer
up vote 1 down vote

That line means there is some process on your machine that is waiting for incoming connections to UDP port 57427. In other words, that process is acting as a server and is prepared to accept incoming connections on that port.

I don't know what [::] means.

share|improve this answer
1  
[::] is any IP address, like 0.0.0.0 used to be in IPv4. – Hendrik Brummermann♦ Apr 14 '12 at 9:47

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.