New here ; a little Netstat question...

[BomBoklaT]

Hi all,

this seems to be a pretty cool place to learn and share knwoledge;i think i like it!
I come to you concerning a question i have about TCP IP connections.
I did a netstat on my work pc coz i was bored, and this is the result (i removed the corp info) ; those are the last four lines of the netstat and they initiated my need for an answer :


TCP HLS10:3020 HLS10.xxxx.xxx:6139 ESTABLISHED
TCP HLS10:3028 HLS10.xxxx.xxx:3029 ESTABLISHED
TCP HLS10:3029 HLS10.xxxx.xxx:3028 ESTABLISHED
TCP HLS10:6139 HLS10.xxxx.xxx:3020 ESTABLISHED

My question is : why do those 4 ports interconnect to eachother?

Another question i have is do you know any software that can list in real-time all outgoing connections from my w2000 box?
I need to know the destination of all outgoing traffic i create...

Thanks a lot for your help!

 

[TimRegester]

Any good ethernet analyser will do this. Ethereal for example is free but I would suggest a version of sniffer or Ultra network sniffer which is a far cheaper alternative and almost as good. You need not capture the packets but merely monitor traffic.

After netstat an ethernet analyser was always my natural next stop.

 

[BomBoklaT]

Hi Tim,

thanks for your reply, one thing though, you say that Ethereal is free but that Sniffer or Ultra network sniffer are cheaper?
I guess i'll just try both...

Anythoughts on the interconnecting ports though?

Cheers!

 

[LloydSev]

Those are more than likely two seperate programs.. one program is using ports 3020 and 6139, and another 3028 nd 3029.

Generally these are services.

Port 3020 is generally used by CIFS.

and 3028 and 3029 is generally used by LiebDevMgmt_A and LiebDevMgmt_DM

Computer/Network Technician
CCNA

 

[BomBoklaT]

Okay thanks a lot for your reply LLoyd!
But why are they inversed?
is it one way input and the other output?

Thanks!

 

[LloydSev]

Well you have to look at it in a client/server formation.

When the client sends something to a server, it comes from a port to another port, then the server sends back the response, it goes from that port back to the original port.

Computer/Network Technician
CCNA

 

[BomBoklaT]

Oh ok i see, just like a null cable modem, thanks a lot for clearing that up Lloyd!
Cheers!

 

[Serbtastic]

As you are using Windows 2000, you will need to use a third party software to show all connections in real time. I suggest TCPView from

http://www.sysinternals.com

(its free).

Windows XP has this function built in (using the netstat -o command).

 

[bcastner]

And port query.
Free as well.

http://support.microsoft.com/default.aspx?scid=kb;en-us;Q310456

 

[chris13]

Or try ActivePorts (freeware). Shows all connections + listening ports, looks up the names, and you may even kill/close connections you don't like (at your own risk ).

http://www.tucows.com/preview/213738.html