So, while I casually did a netstat -a for an unrelated matter I found this connection open that seemed (at least to my untrained eye) strange: enter image description here

Where Name was the last name of another current employee of the company in all caps.

Is this something standard to be on a desktop connected to the company's network(as its the only such name appearing, all the other have my last name/firewall's name or no name), or is it something I should worry about? If the latter, how should I further investigate the matter?

  • What name does the another employee's computer have? Isn't it his name? – Vilican Jul 21 '17 at 12:48
  • Are your laptops hostname set to the employee lastname ? If so, it seems you're connected to a service on this person laptop (I've no clue of which app this can be btw) – Tensibai Jul 21 '17 at 12:49
  • @Tensibai My pc's hostname is set to employee lastname, I assume the rest of the company owned desktops are set the same way. – Leon Jul 21 '17 at 12:51
  • @Leon So this explain why you see this employee name, that's just his/her machine name also as zzarzzur explain in the answer – Tensibai Jul 21 '17 at 12:56
  • Windows ftw I guess :D – Leon Jul 21 '17 at 13:00

If the systems are running Windows 10, it's that feature that allows you to download updates from your peers.

Port 7680 is the listener for the peer service that Windows 10 uses to transmit the update files. If the other employee has their host name set to their last name, that's what will appear on the connection. Windows will locate all of the hosts that are broadcasting themselves, and connect to their host name.

In the event you aren't running Windows 10, it's more suspicious.

|improve this answer|||||
  • I am in fact running windows 10 as well as the majority of the in house devs. And I can confirm the default hostname IT sets in new computers is the same as your last name.Thats interesting, wasnt even aware this feature existed. – Leon Jul 21 '17 at 12:58

This will show the PID the Process is associated to:

netstat -a -o

This will show the .exe responsible for creating the socket:

netstat -a -b
|improve this answer|||||
  • Parent id 1008 which corresponds to svchost which is consistent with @zzarzzur's answer. If I could select both answers as correct I would as this did help me confirm that theory. Thanks – Leon Jul 21 '17 at 13:04
  • 1
    @Leon No problem! – Joshua Faust Jul 21 '17 at 13:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.