Getting "Unknown" entry in active ports

Discussion in 'other security issues & news' started by dr.funk, Feb 16, 2005.

Thread Status:
Not open for further replies.
  1. dr.funk

    dr.funk Guest

    Hi,

    I am getting this "Unknown" entry when using Active Ports and was wondering what it could be.

    Could it be malware/trojan?

    It seems to appear in Active Ports every now and then, not constantly.

    Here's the breakdown of what Active Ports is telling me about the "Unknown" entry.



    Process : Unknown

    P. : 0

    Local IP : 127.0.0.1

    Local Port : 1150

    Remote IP : 127.0.0.1

    Remote Port : 1149

    State : Time_Wait

    Protocol : TCP

    Path : Blank (nothing listed here)



    Thanks very much for any insight on what this could be, and whether or not it is some kind of malware.
     
  2. CrazyM

    CrazyM Firewall Expert

    Joined:
    Feb 9, 2002
    Posts:
    2,428
    Location:
    BC, Canada
    127.0.0.1 is localhost = your own computer or also referred to as loopback.
    This communication is your system/process talking to itself and is not going outside or open to the outside. It is not uncommon to see this as a number of applications/processes will use localhost/loopback connections.

    Regards,

    CrazyM
     
  3. dr.funk

    dr.funk Guest

    Thanks for the help CrazyM. I understand it better now. :)
     
  4. Rasheed187

    Rasheed187 Registered Member

    Joined:
    Jul 10, 2004
    Posts:
    8,010
    Location:
    The Netherlands
    ==================================================
    Protocol : TCP
    Local Port : 0
    Local Port Name :
    Local Address : 0.0.0.0
    Remote Port : 4291
    Remote Port Name :
    Remote Address : 0.0.0.0
    State : Listening
    ==================================================

    And what about this one, I always have this port listening, the remote port differs, is this some app using this port, it can't be no trojan I hope? o_O
     
  5. Rasheed187

    Rasheed187 Registered Member

    Joined:
    Jul 10, 2004
    Posts:
    8,010
    Location:
    The Netherlands
    My bad, I was a bit too a paranoid , it's the Windows Telephony Server that's using the port. :)
     
Loading...
Thread Status:
Not open for further replies.