1

I was hoping someone out there could answer why my Windows 10 Machine would be listening on port 3939 using 127.127.127.127 over TCP?

I get the below with netstat -nat:

TCP    127.127.127.127:3939   0.0.0.0:0              LISTENING       InHost

Could someone help me figure out what this is?

I tried searching Google but came up with nothing, except some vauge references to VMWare (I am using virtualbox). Hoping someone here might know what this is?

  • 1
    "tried searching google but came up with nothing" You mean you got an empty search results page from Google? Can you post a screenshot? – techraf Sep 7 '16 at 4:39
  • Sorry! I meant I couldn't determine from my search what it was. – hooftly Sep 7 '16 at 4:40
  • I edited the post to show full netstat -nat – hooftly Sep 7 '16 at 4:44
  • I did not ask about netstat, but Google Search. Almost all results on the first page point to something that can't be called "nothing". – techraf Sep 7 '16 at 4:46
  • 4
    Any IP address in the 127.x.x.x/8 block is a loopback address (that is a network address that refers to your own computer), though usually 127.0.0.1 is used (but 127.127.127.127 as well as anything else in the 127/8 block also works). – dr jimbob Sep 7 '16 at 4:56
4

A quick TCP port search hints at some ant-virus application related port. Since its listening to the local host ip-address it may be two processes of an application communicating to each other via local host-only TCP sockets.

You can find out the exact process ID by running this command as Administrator:

netstat -aon | find ":3939"

That should reveal which program is using this port.


Edited after discovering that PID 4 uses the port:

Typically HTTP.sys opens a local port on behalf of a system service such as IIS, SQL reporting server, print spooler, etc. These will all show up as PID 4.

Refer to these answers https://superuser.com/questions/352017/pid4-using-port-80 and https://stackoverflow.com/questions/1430141/port-80-is-being-used-by-system-pid-4-what-is-that to identify and try disabling the service corresponding to this particular port.

You could begin by trying to stop the HTTP service and in the process discover which other services rely on it:

NET stop HTTP
  • K well this opens more questions because it shows PID 4 which is NT Kernel & System? – hooftly Sep 7 '16 at 4:56
  • Did you try to use a program like TCPView (technet.microsoft.com/en-us/sysinternals/tcpview.aspx)? – ndrix Sep 7 '16 at 5:00
  • I just used TCPView and it wont let me query the process properties (Probably because its the System Process) – hooftly Sep 7 '16 at 5:07
  • You can open http://127.127.127.127:3939 in a browser and you'll get a 404 message. So far I haven't been able to find a request that doesn't 404. – jdgregson Mar 10 at 8:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.