I used CurrPorts to monitor TCP/IP network connections. This image shows when I don't connect to the Internet but I don't know why Avast Antivirus established this port. Is it insecure?

enter image description here

This image shows when I connected to the Internet and surfing websites. There are so many connections to IP:

enter image description here

What are Insecure TCP/UDP Default Ports or the range of ports what services running on and are possible to permit attacker attack on windows. Is possible to narrow the range of TCP/UDP port?

  • 2
    Almost all of this question is answered with basic networking knowledge and a little research. – schroeder Aug 24 '17 at 9:45
  • Rei - it looks like many of your questions are closed. It's worthwhile having another read of our tour and How to Ask pages to understand why. – Rory Alsop Aug 25 '17 at 11:05
  • Could I delete this questions and put it on superuser.com? @RoryAlsop – Rei Aug 25 '17 at 11:11
  • You can't delete this one as it has upvoted answers, however you can write one over on SU as long as you meet the guidelines on their help page – Rory Alsop Aug 25 '17 at 11:33
  • superuser.com/questions/1244323/… @RoryAlsop – Rei Aug 25 '17 at 11:46

What you show in your image is a connect of Avast to A reverse DNS lookup shows as name sea25.ff.avast.com and a whois lookup shows that this IP is owned by Avast. Thus it is probably perfectly correct for Avast to connect to this server for example for pattern updates or similar. Of course, Avast could also transfer all your secret information from your system to this server but that's the kind of risk you face with any software you install. And, it is very unlikely that a well-known and trusted security company would do it.

As for the seconds IP According to whois it is owned by Level 3 - a very large internet provider which provides connectivity also for various content delivery networks. Thus, it might be such a CDN or it might be not but just looking at the IP address says nothing about the kind of data transferred and if it is dangerous or not.

What is Insecure/Obsolete TCP/UDP Ports/Protocols or the range of ports what is possible to permit attacker attack.

There is no such thing as obsolete ports. There might be some older protocols like gopher (port 70) which are no longer in use but there is no exhaustive list of such ports and the port itself might also be used by different applications.

IPV4 ports range from: 0 --> (2^16)-1. What is the port range of IPV6? Why did someone say that IPV6 is more secure than IPV4? and is possible to narrow the range of TCP/UDP port?

Off-topic. But still: there is no such thing as an IPv4 port or IPv6 port. There are TCP and UDP using ports in the range of up to 2^16-1. They can both use IPv4 or IPv6 as underlying network protocol and this does not affect the range of ports usable.

  • Thank you Steffen Ullrich.I realized silly mistake when calling IPv4 port. yep TCP or UDP using ports in the range of up to 2^16-1. and there is nothing difference about port range of TCP between in IPv6 and IPv4. About image show It's established for connect avast antivirus to get updates.If I wanna check is it harmful, I have to reverse DNS and check is it well-known and trusted security company, internet provider.. Could you advise me the surely trusted antivirus software? – Rei Aug 24 '17 at 10:49
  • Actually your anwser is perfect. It's truly CDN and through that I realized who owned by level 3 is the very large internet provider and I can check at tcpiputils.com but same as @schroeder .it's difficult to know whether those connections to that IP make sense</b> if don't have automatic machine and can't control all something can be harmful or not when surfing internet. – Rei Aug 24 '17 at 10:49
  • 3
    @Rei: "Could you advise me the surely trusted antivirus software?" - this is both a new question (and thus should not be asked in a comment) and also off-topic (product recommendations are off-topic). Apart from that no antivirus is "surely secure" - no one will protect yourself fully. – Steffen Ullrich Aug 24 '17 at 11:13
  1. Just because you are not using a web browser does not mean that you are not connected to the Internet. You computer and a large number of programs connect to the Internet to get updates, for instance. Like your anti-virus.

  2. If you do not know what an IP address is, use a tool like https://www.tcpiputils.com/browse/ip-address/

  3. Without knowing what you were browsing to, it's difficult to know whether those connections to that IP make sense. (they are all typical http connections)

  4. Ports are not insecure and ports do not allow attackers to attack. It's the services on those ports that allow attacks.

  5. To 'narrow the port range' you use a firewall.

  • Thanks @schroeder but according your anwser, someone can running services at port what different from default port.I know several services on ssh can but on windows eg smb service how can change? – Rei Aug 24 '17 at 20:13
  • @Rei I have no idea what you are asking - default ports are only a problem based on the default services running on that port (like SMB) ... – schroeder Aug 25 '17 at 20:43

Not the answer you're looking for? Browse other questions tagged or ask your own question.