Port 6348 TCP ?

[shakenama]

Recently I had changed ISP's. Now when accessing the net my firewall shows traffic going thru port 6348 (UNK) instead of port 80(HTTP). I have an ethernet NIC with Cable modem hooked up. I've checked for possible spyware (Ad-aware) but it shows nothing unusual. confused

I've searched for references for port 6348...but it's an unknown port. Is this something to worry about? Can I adjust the port settings ? And if so...how?...thanks

 

[Accessdabbler]

Is the traffic incoming or outgoing?

After booting your computer, go to a command prompt and type:

netstat -a

If this port shows as Listening or Established, and you aren't using the internet, you probably have a virus program running on your computer.

 

[WheeDoggy]

this is a port commonly used by gnutella, a file sharing program.
maybe this clears things up ?

 

[shakenama]

Wow ! Thanks for the quick response.
Netstat -a (which I'll remember..thanks !) It showed 4 TCP ports open.....137,138,1051, and "nbsession" (whatever that is) which are all listening...and 3 UDP ports are open.
I've done a Virus scan with McAfee which showed no files infected....which isn't a surprise since I did a clean Windows install on my C partition a week ago.

I figured it might be used for Gnutella because port 6346 is so close. But even when I'm not using Kazaa it's showing up.

I reinstalled my firewall (Neowatch, full version)...same thing...most all the tfc is attempting to access port 6348. There is not one hint of Port 80 being accessed.
The far left "Event Info" collunm shows Port 6348 (TCP)......strange
Is this something I should stress over ? Or am I pullin my hair out for no reason ?
Thanks -Shawn

 

[Accessdabbler]

3 open UDP ports? Are you sure?

No UDP ports should be open. If the listing shows *:*, the port is not open.

If someone is trying to connect to Port 6348 and your firewall is blocking it, you are safe. If the hits are becoming more and more prevalent, you can contact your ISP and see if they can block the IP addresses that are incoming to you before they reach your firewall.

Even though the anti-virus shows your system clean you could still have a rogue program running. The virus may have installed the program and then the virus file was deleted.

I've never used Neowatch, preferring ZoneAlarm. What OS are you using?

 

[shakenama]

Thanks Accessdabbler....

I'm getting in touch with my ISP (Cox) so maybe they know why the Port 6348 instead of Port 80 ...... By the way I'm using Windows 98 (still an old favorite....sorry....when it works oooh sooo great why change !)...thanks for ze help