Is it normal to have 2000 tcp connections?

[primexx]

One of the machines on my lan currently has ~2k tcp connections, even with a 120s timeout, is this normal???

[Stephen Veteran]

is it running and P2P software?

[primexx]

is it running and P2P software?

i don't think so, p2p is supposed to be blocked for that comp.

the next most number of connections is ~500 right now.

[zeta_immersion]

say hello to something unwanted .. aka. spam/virus/p2p/the funk

[primexx]

say hello to something unwanted .. aka. spam/virus/p2p/the funk

damn i was afraid of that...

anyone know if you could limit connection count by ip or mac on dd-wrt??

[Colin-uk Veteran]

type 'netstat -b' in the command prompt and see where and what is making those connections.

I would probly do a spyware/virus check too.

[primexx]

type 'netstat -b' in the command prompt and see where and what is making those connections.

I would probly do a spyware/virus check too.

it says illegal command?

[tsupersonic]

Update your antivirus and antispyware etc, then unhook from the internet. Boot into safe mode, then run the antivirus and antispyware. The safe mode part is important

2000 is way too damn much. Using the netstat -b command in cmd prompt, it shows 2 for me, and it's just Opera

[primexx]

Update your antivirus and antispyware etc, then unhook from the internet. Boot into safe mode, then run the antivirus and antispyware. The safe mode part is important

2000 is way too damn much. Using the netstat -b command in cmd prompt, it shows 2 for me, and it's just Opera

oh netstat on the computer! I don't have control/access to it. And i don't really care if it's infected as long as it doesn't bring the rest of the network down...so if there's no way of limiting connections by client i guess i'll have to tell them to check their comp...blah...

[5c077]

That's crazy, I'd definitely take that computer offline until you remove whatever is causing that. It's more than likely infected to the point it needs a format.

[+BudMan MVC]

i don't really care if it's infected

:blink: WTF dude??? Your joking right???

[primexx]

:blink: WTF dude??? Your joking right???

read the second part: as long as it doesn't take the rest of the lan down.

(oh and none of the computers are actually networked together, so i should be safe...correct me if i'm wrong please?)

So...any way to limit connections by client???

Edited July 6, 2008 by Primexx

[MrKuro]

i generally have around upwards of 3000 tcp connections, but when running heavy torrent transfers, which is usually 24/7 (maxing my connection bandwidth), however when not doing those activities i might have 20-50 connections going on (web/terminal services traffic)

so .. if your not using p2p, you probably have some spyware/virus going on.

[primexx]

i generally have around upwards of 3000 tcp connections, but when running heavy torrent transfers, which is usually 24/7 (maxing my connection bandwidth), however when not doing those activities i might have 20-50 connections going on (web/terminal services traffic)

so .. if your not using p2p, you probably have some spyware/virus going on.

the other possibility, i guess, is that dd-wrt's p2p blocking doesn't actually do what it says, i don't doubt the possibility.

[h3xis]

what version of dd-wrt? if you're running v24 you can see what the connections are.

[primexx]

what version of dd-wrt? if you're running v24 you can see what the connections are.

i can but i can't make sense of them

[h3xis]

why not? what are the source addresses? are they all different or what?

[primexx]

why not? what are the source addresses? are they all different or what?

there's no single or even a few recurring IPs

[DaTech]

get a router!

IF YOU HAVE INTERNET YOU SHOULD HAVE A ROUTER!!!

unless you already got one but it sure don't sound like it!

[PermaSt0ne]

get a router!

IF YOU HAVE INTERNET YOU SHOULD HAVE A ROUTER!!!

unless you already got one but it sure don't sound like it!

.......ummm yea try reading that one more time

as for the OP, most torrents and p2p have a way of getting past firewalls and routers. they randomize the ports they go through and can encrypt their traffic. even if you block all the ports except for 80 they can still work

i know of no way to guarantee that torrent and p2p traffic won't work. maybe budman knows :huh:

[h3xis]

get a router!

IF YOU HAVE INTERNET YOU SHOULD HAVE A ROUTER!!!

unless you already got one but it sure don't sound like it!

facepalm

there's no single or even a few recurring IPs

so let me get this straight, one of your machines has ~2000 tcp connections, but hardly any of them (if any) are showing up in the active connections list?

[primexx]

facepalm

so let me get this straight, one of your machines has ~2000 tcp connections, but hardly any of them (if any) are showing up in the active connections list?

oh I see the list, but there's no single IP it's connecting to, and I haven't found a feasible way of analyzing a thousand or so unique IPs from a copy+paste of the list yet.

[primexx]

I have a sample (csv) of the connections, should I post it?

Edited July 6, 2008 by Primexx

[+shift. MVC]

get a router!

IF YOU HAVE INTERNET YOU SHOULD HAVE A ROUTER!!!

unless you already got one but it sure don't sound like it!

:rolleyes:

He did say he was running DD-WRT. :p