Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Is this normal? Can any ports be "dangerous"?

I have 9 tcp's in a listening state, 4 in a close_wait state, and 4 in an established state.

Some of them route to odd procceses using PID such as default tab.exe. A lot of them are from IObit in states: close_wait and established.

Something I am worried about is some of the PID aren't showing up in task manager, not sure if that is a product of it being my local address with like :135, 445, 554...etc... what does those numbers mean at the end?

Example would be : (local adress) 0.0.0.0:135 to foreign address 0.0.0.0 State is listening, PID is 940 but I can't find the PID so I'm not sure what proccess is causing it and that seems odd.

Ok, so now I actually know what TCP is but I'm still wondering why the PID is not showing up on task manager for some of the connections?

share|improve this question

2 Answers 2

It can be perfectly normal but it can also be dangerous. The :number after an IP address is the port number. I would investigate the processes that own them. Use something like SysInternal's Process Explorer and make sure to run it in admin mode to make sure you get all processes. Sometimes processes can be nested within another and don't necessarily always show in the normal Task Manager.

If they are all processes that you know, then I wouldn't be worried.

share|improve this answer

Any port # could be used dangerously. A port number is just a field in the transport layer used for multiplexing your messages incoming to your network card to the right application level service. Granted for connecting to common services there's a standarized well-known port number; e.g., if you connect to a web server via HTTP without specifying a port number the web server runs on port 80 (though the connection from your end will be a random OS-assigned port #). You can look up well-known services in the IANA list.

For example, you mentioned port 135. In windows, that's a common port for epmap/DCE end-point resolution, which is used for remote procedure calls for managing standard windows services (e.g., like DHCP server, DNS server, WINS, SMB, etc). Granted, malware also may choose to use port 135 as well.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.