1

I was hoping someone out there could answer why my Windows 10 Machine would be listening on port 3939 using 127.127.127.127 over TCP?

I get the below with netstat -nat:

TCP    127.127.127.127:3939   0.0.0.0:0              LISTENING       InHost

Could someone help me figure out what this is?

I tried searching Google but came up with nothing, except some vauge references to VMWare (I am using virtualbox). Hoping someone here might know what this is?

7
  • 1
    "tried searching google but came up with nothing" You mean you got an empty search results page from Google? Can you post a screenshot?
    – techraf
    Commented Sep 7, 2016 at 4:39
  • Sorry! I meant I couldn't determine from my search what it was.
    – hooftly
    Commented Sep 7, 2016 at 4:40
  • I edited the post to show full netstat -nat
    – hooftly
    Commented Sep 7, 2016 at 4:44
  • I did not ask about netstat, but Google Search. Almost all results on the first page point to something that can't be called "nothing".
    – techraf
    Commented Sep 7, 2016 at 4:46
  • 4
    Any IP address in the 127.x.x.x/8 block is a loopback address (that is a network address that refers to your own computer), though usually 127.0.0.1 is used (but 127.127.127.127 as well as anything else in the 127/8 block also works).
    – dr jimbob
    Commented Sep 7, 2016 at 4:56

1 Answer 1

4

A quick TCP port search hints at some ant-virus application related port. Since its listening to the local host ip-address it may be two processes of an application communicating to each other via local host-only TCP sockets.

You can find out the exact process ID by running this command as Administrator:

netstat -aon | find ":3939"

That should reveal which program is using this port.


Edited after discovering that PID 4 uses the port:

Typically HTTP.sys opens a local port on behalf of a system service such as IIS, SQL reporting server, print spooler, etc. These will all show up as PID 4.

Refer to these answers https://superuser.com/questions/352017/pid4-using-port-80 and https://stackoverflow.com/questions/1430141/port-80-is-being-used-by-system-pid-4-what-is-that to identify and try disabling the service corresponding to this particular port.

You could begin by trying to stop the HTTP service and in the process discover which other services rely on it:

NET stop HTTP
4
  • K well this opens more questions because it shows PID 4 which is NT Kernel & System?
    – hooftly
    Commented Sep 7, 2016 at 4:56
  • Did you try to use a program like TCPView (technet.microsoft.com/en-us/sysinternals/tcpview.aspx)?
    – ndrix
    Commented Sep 7, 2016 at 5:00
  • I just used TCPView and it wont let me query the process properties (Probably because its the System Process)
    – hooftly
    Commented Sep 7, 2016 at 5:07
  • You can open http://127.127.127.127:3939 in a browser and you'll get a 404 message. So far I haven't been able to find a request that doesn't 404.
    – jdgregson
    Commented Mar 10, 2019 at 8:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .