So, while I casually did a netstat -a for an unrelated matter I found this connection open that seemed (at least to my untrained eye) strange: enter image description here

Where Name was the last name of another current employee of the company in all caps.

Is this something standard to be on a desktop connected to the company's network(as its the only such name appearing, all the other have my last name/firewall's name or no name), or is it something I should worry about? If the latter, how should I further investigate the matter?

  • What name does the another employee's computer have? Isn't it his name?
    – Vilican
    Jul 21, 2017 at 12:48
  • Are your laptops hostname set to the employee lastname ? If so, it seems you're connected to a service on this person laptop (I've no clue of which app this can be btw)
    – Tensibai
    Jul 21, 2017 at 12:49
  • @Tensibai My pc's hostname is set to employee lastname, I assume the rest of the company owned desktops are set the same way.
    – Leon
    Jul 21, 2017 at 12:51
  • @Leon So this explain why you see this employee name, that's just his/her machine name also as zzarzzur explain in the answer
    – Tensibai
    Jul 21, 2017 at 12:56
  • Windows ftw I guess :D
    – Leon
    Jul 21, 2017 at 13:00

2 Answers 2


If the systems are running Windows 10, it's that feature that allows you to download updates from your peers.

Port 7680 is the listener for the peer service that Windows 10 uses to transmit the update files. If the other employee has their host name set to their last name, that's what will appear on the connection. Windows will locate all of the hosts that are broadcasting themselves, and connect to their host name.

In the event you aren't running Windows 10, it's more suspicious.

  • I am in fact running windows 10 as well as the majority of the in house devs. And I can confirm the default hostname IT sets in new computers is the same as your last name.Thats interesting, wasnt even aware this feature existed.
    – Leon
    Jul 21, 2017 at 12:58

This will show the PID the Process is associated to:

netstat -a -o

This will show the .exe responsible for creating the socket:

netstat -a -b
  • Parent id 1008 which corresponds to svchost which is consistent with @zzarzzur's answer. If I could select both answers as correct I would as this did help me confirm that theory. Thanks
    – Leon
    Jul 21, 2017 at 13:04
  • 1
    @Leon No problem! Jul 21, 2017 at 13:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .