TCP/IP Error Help


Recommended Posts

I'm getting this error persistently on my wireless conection:

Log Name: System

Source: Tcpip

Event ID: 4227

Level: Warning

TCP/IP failed to establish an outgoing connection because the selected local

endpoint was recently used to connect to the same remote endpoint. This

error typically occurs when outgoing connections are opened and closed at a

high rate, causing all available local ports to be used and forcing TCP/IP

to reuse a local port for an outgoing connection. To minimize the risk of

data corruption, the TCP/IP standard requires a minimum time period to

elapse between successive connections from a given local endpoint to a given

remote endpoint.

My computer is connected via wireless to a D-Link DIR-655 router and the router is connected directly to a Motorola Surfboard 5120 Cable Modem. Any help on how to avoid this annoyance will be appreciated.

Link to comment
https://www.neowin.net/forum/topic/844138-tcpip-error-help/
Share on other sites

"causing all available local ports to be used"

Sounds like you used up all your ports.. there are 65535 of them!

I would guess your infected with something to be sure.. Or you got something that is forcing the use of new port everytime it makes a connection to the same IP??

What does the output of netstat -anb look like.. Which proccess is making all the connections and to where?

You should be able to clear it by disabling your interface and then re-enabling it.

But you must have something screaming through your connection ports making outbound connections to run into that type of error.

I ran netstat -anb and this is what I got.

Microsoft Windows [Version 6.1.7600]

Copyright © 2009 Microsoft Corporation. All rights reserved.

C:\Users\Biotoxic>netstat -anb

Active Connections

Proto Local Address Foreign Address State

TCP 0.0.0.0:135 0.0.0.0:0 LISTENING

RpcSs

[svchost.exe]

TCP 0.0.0.0:445 0.0.0.0:0 LISTENING

Can not obtain ownership information

TCP 0.0.0.0:554 0.0.0.0:0 LISTENING

[wmpnetwk.exe]

TCP 0.0.0.0:2869 0.0.0.0:0 LISTENING

Can not obtain ownership information

TCP 0.0.0.0:5357 0.0.0.0:0 LISTENING

Can not obtain ownership information

TCP 0.0.0.0:10243 0.0.0.0:0 LISTENING

Can not obtain ownership information

TCP 0.0.0.0:49152 0.0.0.0:0 LISTENING

[wininit.exe]

TCP 0.0.0.0:49153 0.0.0.0:0 LISTENING

eventlog

[svchost.exe]

TCP 0.0.0.0:49154 0.0.0.0:0 LISTENING

Schedule

[svchost.exe]

TCP 0.0.0.0:49155 0.0.0.0:0 LISTENING

[services.exe]

TCP 0.0.0.0:49157 0.0.0.0:0 LISTENING

[lsass.exe]

TCP 127.0.0.1:5354 0.0.0.0:0 LISTENING

[mDNSResponder.exe]

TCP 127.0.0.1:27015 0.0.0.0:0 LISTENING

[AppleMobileDeviceService.exe]

TCP 127.0.0.1:49158 0.0.0.0:0 LISTENING

[ccSvcHst.exe]

TCP 127.0.0.1:49198 0.0.0.0:0 LISTENING

[msnmsgr.exe]

TCP 127.0.0.1:49198 127.0.0.1:49199 ESTABLISHED

[msnmsgr.exe]

TCP 127.0.0.1:49199 127.0.0.1:49198 ESTABLISHED

[msnmsgr.exe]

TCP 127.0.0.1:49237 127.0.0.1:49238 ESTABLISHED

[firefox.exe]

TCP 127.0.0.1:49238 127.0.0.1:49237 ESTABLISHED

[firefox.exe]

TCP 127.0.0.1:49240 127.0.0.1:49241 ESTABLISHED

[firefox.exe]

TCP 127.0.0.1:49241 127.0.0.1:49240 ESTABLISHED

[firefox.exe]

TCP 192.168.0.199:139 0.0.0.0:0 LISTENING

Can not obtain ownership information

TCP 192.168.0.199:49196 65.54.49.137:1863 ESTABLISHED

[msnmsgr.exe]

TCP 192.168.0.199:49403 64.237.231.247:61494 CLOSE_WAIT

[msnmsgr.exe]

TCP 192.168.0.199:49527 70.119.185.224:65211 ESTABLISHED

[msnmsgr.exe]

TCP 192.168.0.199:49545 174.20.165.91:51498 ESTABLISHED

[msnmsgr.exe]

TCP 192.168.0.199:50816 8.12.226.77:80 ESTABLISHED

[firefox.exe]

TCP 192.168.0.199:50825 96.17.106.115:80 ESTABLISHED

[firefox.exe]

TCP 192.168.0.199:50828 72.14.209.101:80 ESTABLISHED

[firefox.exe]

TCP 192.168.0.199:50849 8.12.226.77:80 ESTABLISHED

[firefox.exe]

TCP 192.168.0.199:50920 209.17.73.7:80 CLOSE_WAIT

[firefox.exe]

TCP 192.168.0.199:50967 64.215.156.43:80 ESTABLISHED

[firefox.exe]

TCP 192.168.0.199:51012 96.17.106.152:80 ESTABLISHED

[firefox.exe]

TCP 192.168.0.199:51013 96.17.106.152:80 ESTABLISHED

[firefox.exe]

TCP 192.168.0.199:51014 96.17.106.152:80 ESTABLISHED

[firefox.exe]

TCP 192.168.0.199:51015 96.17.106.152:80 ESTABLISHED

[firefox.exe]

TCP 192.168.0.199:51016 96.17.106.90:80 ESTABLISHED

[firefox.exe]

TCP 192.168.0.199:51056 74.125.67.156:80 ESTABLISHED

[firefox.exe]

TCP 192.168.0.199:51059 74.125.67.156:80 ESTABLISHED

[firefox.exe]

TCP 192.168.0.199:51074 74.125.67.149:80 ESTABLISHED

[firefox.exe]

TCP 192.168.0.199:51078 96.17.106.123:80 ESTABLISHED

[firefox.exe]

TCP 192.168.0.199:51080 96.17.106.147:80 ESTABLISHED

[firefox.exe]

TCP 192.168.0.199:51090 143.127.102.125:80 TIME_WAIT

TCP 192.168.0.199:51109 65.54.167.59:80 ESTABLISHED

[msnmsgr.exe]

TCP [::]:135 [::]:0 LISTENING

RpcSs

[svchost.exe]

TCP [::]:445 [::]:0 LISTENING

Can not obtain ownership information

TCP [::]:554 [::]:0 LISTENING

[wmpnetwk.exe]

TCP [::]:2869 [::]:0 LISTENING

Can not obtain ownership information

TCP [::]:3587 [::]:0 LISTENING

p2pimsvc

[svchost.exe]

TCP [::]:5357 [::]:0 LISTENING

Can not obtain ownership information

TCP [::]:10243 [::]:0 LISTENING

Can not obtain ownership information

TCP [::]:49152 [::]:0 LISTENING

[wininit.exe]

TCP [::]:49153 [::]:0 LISTENING

eventlog

[svchost.exe]

TCP [::]:49154 [::]:0 LISTENING

Schedule

[svchost.exe]

TCP [::]:49155 [::]:0 LISTENING

[services.exe]

TCP [::]:49157 [::]:0 LISTENING

[lsass.exe]

TCP [::1]:49159 [::]:0 LISTENING

[ccSvcHst.exe]

UDP 0.0.0.0:500 *:*

IKEEXT

[svchost.exe]

UDP 0.0.0.0:3544 *:*

iphlpsvc

[svchost.exe]

UDP 0.0.0.0:3702 *:*

EventSystem

[svchost.exe]

UDP 0.0.0.0:3702 *:*

FDResPub

[svchost.exe]

UDP 0.0.0.0:3702 *:*

EventSystem

[svchost.exe]

UDP 0.0.0.0:3702 *:*

FDResPub

[svchost.exe]

UDP 0.0.0.0:4500 *:*

IKEEXT

[svchost.exe]

UDP 0.0.0.0:5004 *:*

[wmpnetwk.exe]

UDP 0.0.0.0:5005 *:*

[wmpnetwk.exe]

UDP 0.0.0.0:5355 *:*

Dnscache

[svchost.exe]

UDP 0.0.0.0:52198 *:*

EventSystem

[svchost.exe]

UDP 0.0.0.0:52200 *:*

EventSystem

[svchost.exe]

UDP 0.0.0.0:61065 *:*

[mDNSResponder.exe]

UDP 0.0.0.0:64477 *:*

[mDNSResponder.exe]

UDP 0.0.0.0:64479 *:*

FDResPub

[svchost.exe]

UDP 127.0.0.1:1900 *:*

SSDPSRV

[svchost.exe]

UDP 127.0.0.1:50371 *:*

[ccSvcHst.exe]

UDP 127.0.0.1:52443 *:*

[wlcomm.exe]

UDP 127.0.0.1:56807 *:*

[msnmsgr.exe]

UDP 127.0.0.1:57935 *:*

SSDPSRV

[svchost.exe]

UDP 192.168.0.199:9 *:*

[msnmsgr.exe]

UDP 192.168.0.199:137 *:*

Can not obtain ownership information

UDP 192.168.0.199:138 *:*

Can not obtain ownership information

UDP 192.168.0.199:1900 *:*

SSDPSRV

[svchost.exe]

UDP 192.168.0.199:5353 *:*

[mDNSResponder.exe]

UDP 192.168.0.199:54393 *:*

iphlpsvc

[svchost.exe]

UDP 192.168.0.199:57934 *:*

SSDPSRV

[svchost.exe]

UDP [::]:500 *:*

IKEEXT

[svchost.exe]

UDP [::]:3540 *:*

p2pimsvc

[svchost.exe]

UDP [::]:3702 *:*

FDResPub

[svchost.exe]

UDP [::]:3702 *:*

EventSystem

[svchost.exe]

UDP [::]:3702 *:*

FDResPub

[svchost.exe]

UDP [::]:3702 *:*

EventSystem

[svchost.exe]

UDP [::]:4500 *:*

IKEEXT

[svchost.exe]

UDP [::]:5004 *:*

[wmpnetwk.exe]

UDP [::]:5005 *:*

[wmpnetwk.exe]

UDP [::]:5355 *:*

Dnscache

[svchost.exe]

UDP [::]:52199 *:*

EventSystem

[svchost.exe]

UDP [::]:52201 *:*

EventSystem

[svchost.exe]

UDP [::]:64478 *:*

[mDNSResponder.exe]

UDP [::]:64480 *:*

FDResPub

[svchost.exe]

UDP [::1]:1900 *:*

SSDPSRV

[svchost.exe]

UDP [::1]:57933 *:*

SSDPSRV

[svchost.exe]

UDP [fe80::c096:2dd8:f01f:ab5a%11]:1900 *:*

SSDPSRV

[svchost.exe]

UDP [fe80::c096:2dd8:f01f:ab5a%11]:57932 *:*

SSDPSRV

[svchost.exe]

C:\Users\Biotoxic>

Thanks in advance Budman for any help finding out wtf is causing this.

EDIT: placed plain text instead. Much easier to read.

Edited by Biotoxic_hazard_835

Seems like you got quite a few connections to google there? I see one to photobucket

Do me a favor, close firefox when you do the netstat -anb again, and then in a couple of minutes do it again. Without running firefox between.. You need to see if firefox is opening up connections without you.

Lots of worms can search google looking for next target, etc. Each time it makes a new connection it would be using up a local port, etc.

What exactly were you doing on firefox when you took that netstat?

Ok, yesterday I was just browsing around and did 3 Google searches and accessed photobucket once. I have run both NIS 2010 and Malwarebytes and both show a clean system. Here are the netstat -anb info as you requested. Run 3 instances 5 minutes apart, first 2 without opening Firefox and the third one after opening Firefox to My Yahoo and Neowin.

Microsoft Windows [Version 6.1.7600]

Copyright © 2009 Microsoft Corporation. All rights reserved.

C:\Users\Biotoxic>netstat -anb

Active Connections

Proto Local Address Foreign Address State

TCP 0.0.0.0:135 0.0.0.0:0 LISTENING

RpcSs

[svchost.exe]

TCP 0.0.0.0:445 0.0.0.0:0 LISTENING

Can not obtain ownership information

TCP 0.0.0.0:554 0.0.0.0:0 LISTENING

[wmpnetwk.exe]

TCP 0.0.0.0:2869 0.0.0.0:0 LISTENING

Can not obtain ownership information

TCP 0.0.0.0:5357 0.0.0.0:0 LISTENING

Can not obtain ownership information

TCP 0.0.0.0:10243 0.0.0.0:0 LISTENING

Can not obtain ownership information

TCP 0.0.0.0:49152 0.0.0.0:0 LISTENING

[wininit.exe]

TCP 0.0.0.0:49153 0.0.0.0:0 LISTENING

eventlog

[svchost.exe]

TCP 0.0.0.0:49154 0.0.0.0:0 LISTENING

Schedule

[svchost.exe]

TCP 0.0.0.0:49155 0.0.0.0:0 LISTENING

[services.exe]

TCP 0.0.0.0:49157 0.0.0.0:0 LISTENING

[lsass.exe]

TCP 127.0.0.1:2869 127.0.0.1:49170 TIME_WAIT

TCP 127.0.0.1:5354 0.0.0.0:0 LISTENING

[mDNSResponder.exe]

TCP 127.0.0.1:5357 127.0.0.1:49169 TIME_WAIT

TCP 127.0.0.1:5357 127.0.0.1:49188 TIME_WAIT

TCP 127.0.0.1:27015 0.0.0.0:0 LISTENING

[AppleMobileDeviceService.exe]

TCP 127.0.0.1:49158 0.0.0.0:0 LISTENING

[ccSvcHst.exe]

TCP 127.0.0.1:49161 127.0.0.1:49160 TIME_WAIT

TCP 127.0.0.1:49200 0.0.0.0:0 LISTENING

[msnmsgr.exe]

TCP 127.0.0.1:49200 127.0.0.1:49202 ESTABLISHED

[msnmsgr.exe]

TCP 127.0.0.1:49202 127.0.0.1:49200 ESTABLISHED

[msnmsgr.exe]

TCP 192.168.0.199:139 0.0.0.0:0 LISTENING

Can not obtain ownership information

TCP 192.168.0.199:49162 213.35.100.25:80 TIME_WAIT

TCP 192.168.0.199:49165 213.35.100.25:80 TIME_WAIT

TCP 192.168.0.199:49167 213.35.100.25:80 TIME_WAIT

TCP 192.168.0.199:49168 213.35.100.25:80 TIME_WAIT

TCP 192.168.0.199:49173 192.168.0.1:80 TIME_WAIT

TCP 192.168.0.199:49174 192.168.0.1:9393 TIME_WAIT

TCP 192.168.0.199:49175 192.168.0.1:80 TIME_WAIT

TCP 192.168.0.199:49176 192.168.0.1:9393 TIME_WAIT

TCP 192.168.0.199:49177 192.168.0.1:80 TIME_WAIT

TCP 192.168.0.199:49178 192.168.0.1:9393 TIME_WAIT

TCP 192.168.0.199:49184 192.168.0.1:9393 TIME_WAIT

TCP 192.168.0.199:49191 65.55.184.152:80 ESTABLISHED

wuauserv

[svchost.exe]

TCP 192.168.0.199:49195 65.55.184.152:443 ESTABLISHED

wuauserv

[svchost.exe]

TCP 192.168.0.199:49197 65.54.52.62:1863 TIME_WAIT

TCP 192.168.0.199:49198 65.54.49.45:1863 ESTABLISHED

[msnmsgr.exe]

TCP 192.168.0.199:49199 65.55.7.141:80 TIME_WAIT

TCP 192.168.0.199:49203 65.55.197.115:80 ESTABLISHED

[msnmsgr.exe]

TCP 192.168.0.199:49204 207.46.125.253:7001 TIME_WAIT

TCP 192.168.0.199:49204 207.46.125.254:7001 TIME_WAIT

TCP 192.168.0.199:49206 192.168.0.1:80 TIME_WAIT

TCP 192.168.0.199:49207 192.168.0.1:9393 TIME_WAIT

TCP 192.168.0.199:49208 192.168.0.1:80 TIME_WAIT

TCP 192.168.0.199:49209 192.168.0.1:9393 TIME_WAIT

TCP 192.168.0.199:49210 192.168.0.1:80 TIME_WAIT

TCP 192.168.0.199:49211 192.168.0.1:9393 TIME_WAIT

TCP 192.168.0.199:49221 192.168.0.1:9393 TIME_WAIT

TCP 192.168.0.199:49222 168.75.207.20:80 ESTABLISHED

[msnmsgr.exe]

TCP 192.168.0.199:49227 65.54.167.92:80 ESTABLISHED

[msnmsgr.exe]

TCP [::]:135 [::]:0 LISTENING

RpcSs

[svchost.exe]

TCP [::]:445 [::]:0 LISTENING

Can not obtain ownership information

TCP [::]:554 [::]:0 LISTENING

[wmpnetwk.exe]

TCP [::]:2869 [::]:0 LISTENING

Can not obtain ownership information

TCP [::]:3587 [::]:0 LISTENING

p2pimsvc

[svchost.exe]

TCP [::]:5357 [::]:0 LISTENING

Can not obtain ownership information

TCP [::]:10243 [::]:0 LISTENING

Can not obtain ownership information

TCP [::]:49152 [::]:0 LISTENING

[wininit.exe]

TCP [::]:49153 [::]:0 LISTENING

eventlog

[svchost.exe]

TCP [::]:49154 [::]:0 LISTENING

Schedule

[svchost.exe]

TCP [::]:49155 [::]:0 LISTENING

[services.exe]

TCP [::]:49157 [::]:0 LISTENING

[lsass.exe]

TCP [::1]:49159 [::]:0 LISTENING

[ccSvcHst.exe]

UDP 0.0.0.0:500 *:*

IKEEXT

[svchost.exe]

UDP 0.0.0.0:3544 *:*

iphlpsvc

[svchost.exe]

UDP 0.0.0.0:3702 *:*

EventSystem

[svchost.exe]

UDP 0.0.0.0:3702 *:*

EventSystem

[svchost.exe]

UDP 0.0.0.0:3702 *:*

FDResPub

[svchost.exe]

UDP 0.0.0.0:3702 *:*

FDResPub

[svchost.exe]

UDP 0.0.0.0:4500 *:*

IKEEXT

[svchost.exe]

UDP 0.0.0.0:5004 *:*

[wmpnetwk.exe]

UDP 0.0.0.0:5005 *:*

[wmpnetwk.exe]

UDP 0.0.0.0:5355 *:*

Dnscache

[svchost.exe]

UDP 0.0.0.0:52676 *:*

[mDNSResponder.exe]

UDP 0.0.0.0:52678 *:*

FDResPub

[svchost.exe]

UDP 0.0.0.0:53049 *:*

[mDNSResponder.exe]

UDP 0.0.0.0:58412 *:*

EventSystem

[svchost.exe]

UDP 0.0.0.0:58418 *:*

EventSystem

[svchost.exe]

UDP 127.0.0.1:1900 *:*

SSDPSRV

[svchost.exe]

UDP 127.0.0.1:54292 *:*

[msnmsgr.exe]

UDP 127.0.0.1:58417 *:*

SSDPSRV

[svchost.exe]

UDP 127.0.0.1:63184 *:*

[wlcomm.exe]

UDP 192.168.0.199:9 *:*

[msnmsgr.exe]

UDP 192.168.0.199:137 *:*

Can not obtain ownership information

UDP 192.168.0.199:138 *:*

Can not obtain ownership information

UDP 192.168.0.199:1900 *:*

SSDPSRV

[svchost.exe]

UDP 192.168.0.199:5353 *:*

[mDNSResponder.exe]

UDP 192.168.0.199:54393 *:*

iphlpsvc

[svchost.exe]

UDP 192.168.0.199:58416 *:*

SSDPSRV

[svchost.exe]

UDP [::]:500 *:*

IKEEXT

[svchost.exe]

UDP [::]:3540 *:*

p2pimsvc

[svchost.exe]

UDP [::]:3702 *:*

FDResPub

[svchost.exe]

UDP [::]:3702 *:*

EventSystem

[svchost.exe]

UDP [::]:3702 *:*

FDResPub

[svchost.exe]

UDP [::]:3702 *:*

EventSystem

[svchost.exe]

UDP [::]:4500 *:*

IKEEXT

[svchost.exe]

UDP [::]:5004 *:*

[wmpnetwk.exe]

UDP [::]:5005 *:*

[wmpnetwk.exe]

UDP [::]:5355 *:*

Dnscache

[svchost.exe]

UDP [::]:52677 *:*

[mDNSResponder.exe]

UDP [::]:52679 *:*

FDResPub

[svchost.exe]

UDP [::]:58413 *:*

EventSystem

[svchost.exe]

UDP [::]:58419 *:*

EventSystem

[svchost.exe]

UDP [::1]:1900 *:*

SSDPSRV

[svchost.exe]

UDP [::1]:58415 *:*

SSDPSRV

[svchost.exe]

UDP [fe80::c096:2dd8:f01f:ab5a%11]:1900 *:*

SSDPSRV

[svchost.exe]

UDP [fe80::c096:2dd8:f01f:ab5a%11]:58414 *:*

SSDPSRV

[svchost.exe]

C:\Users\Biotoxic>

Microsoft Windows [Version 6.1.7600]

Copyright © 2009 Microsoft Corporation. All rights reserved.

C:\Users\Biotoxic>netstat -anb

Active Connections

Proto Local Address Foreign Address State

TCP 0.0.0.0:135 0.0.0.0:0 LISTENING

RpcSs

[svchost.exe]

TCP 0.0.0.0:445 0.0.0.0:0 LISTENING

Can not obtain ownership information

TCP 0.0.0.0:554 0.0.0.0:0 LISTENING

[wmpnetwk.exe]

TCP 0.0.0.0:2869 0.0.0.0:0 LISTENING

Can not obtain ownership information

TCP 0.0.0.0:5357 0.0.0.0:0 LISTENING

Can not obtain ownership information

TCP 0.0.0.0:10243 0.0.0.0:0 LISTENING

Can not obtain ownership information

TCP 0.0.0.0:49152 0.0.0.0:0 LISTENING

[wininit.exe]

TCP 0.0.0.0:49153 0.0.0.0:0 LISTENING

eventlog

[svchost.exe]

TCP 0.0.0.0:49154 0.0.0.0:0 LISTENING

Schedule

[svchost.exe]

TCP 0.0.0.0:49155 0.0.0.0:0 LISTENING

[services.exe]

TCP 0.0.0.0:49157 0.0.0.0:0 LISTENING

[lsass.exe]

TCP 127.0.0.1:5354 0.0.0.0:0 LISTENING

[mDNSResponder.exe]

TCP 127.0.0.1:27015 0.0.0.0:0 LISTENING

[AppleMobileDeviceService.exe]

TCP 127.0.0.1:49158 0.0.0.0:0 LISTENING

[ccSvcHst.exe]

TCP 127.0.0.1:49200 0.0.0.0:0 LISTENING

[msnmsgr.exe]

TCP 127.0.0.1:49200 127.0.0.1:49202 ESTABLISHED

[msnmsgr.exe]

TCP 127.0.0.1:49202 127.0.0.1:49200 ESTABLISHED

[msnmsgr.exe]

TCP 192.168.0.199:139 0.0.0.0:0 LISTENING

Can not obtain ownership information

TCP 192.168.0.199:49198 65.54.49.45:1863 ESTABLISHED

[msnmsgr.exe]

TCP 192.168.0.199:49259 65.55.197.115:80 CLOSE_WAIT

[msnmsgr.exe]

TCP 192.168.0.199:49260 65.55.197.115:80 CLOSE_WAIT

[msnmsgr.exe]

TCP [::]:135 [::]:0 LISTENING

RpcSs

[svchost.exe]

TCP [::]:445 [::]:0 LISTENING

Can not obtain ownership information

TCP [::]:554 [::]:0 LISTENING

[wmpnetwk.exe]

TCP [::]:2869 [::]:0 LISTENING

Can not obtain ownership information

TCP [::]:3587 [::]:0 LISTENING

p2pimsvc

[svchost.exe]

TCP [::]:5357 [::]:0 LISTENING

Can not obtain ownership information

TCP [::]:10243 [::]:0 LISTENING

Can not obtain ownership information

TCP [::]:49152 [::]:0 LISTENING

[wininit.exe]

TCP [::]:49153 [::]:0 LISTENING

eventlog

[svchost.exe]

TCP [::]:49154 [::]:0 LISTENING

Schedule

[svchost.exe]

TCP [::]:49155 [::]:0 LISTENING

[services.exe]

TCP [::]:49157 [::]:0 LISTENING

[lsass.exe]

TCP [::1]:49159 [::]:0 LISTENING

[ccSvcHst.exe]

UDP 0.0.0.0:500 *:*

IKEEXT

[svchost.exe]

UDP 0.0.0.0:3544 *:*

iphlpsvc

[svchost.exe]

UDP 0.0.0.0:3702 *:*

EventSystem

[svchost.exe]

UDP 0.0.0.0:3702 *:*

FDResPub

[svchost.exe]

UDP 0.0.0.0:3702 *:*

FDResPub

[svchost.exe]

UDP 0.0.0.0:3702 *:*

EventSystem

[svchost.exe]

UDP 0.0.0.0:4500 *:*

IKEEXT

[svchost.exe]

UDP 0.0.0.0:5004 *:*

[wmpnetwk.exe]

UDP 0.0.0.0:5005 *:*

[wmpnetwk.exe]

UDP 0.0.0.0:5355 *:*

Dnscache

[svchost.exe]

UDP 0.0.0.0:52676 *:*

[mDNSResponder.exe]

UDP 0.0.0.0:52678 *:*

FDResPub

[svchost.exe]

UDP 0.0.0.0:53049 *:*

[mDNSResponder.exe]

UDP 0.0.0.0:58412 *:*

EventSystem

[svchost.exe]

UDP 0.0.0.0:58418 *:*

EventSystem

[svchost.exe]

UDP 127.0.0.1:1900 *:*

SSDPSRV

[svchost.exe]

UDP 127.0.0.1:54292 *:*

[msnmsgr.exe]

UDP 127.0.0.1:58417 *:*

SSDPSRV

[svchost.exe]

UDP 127.0.0.1:63184 *:*

[wlcomm.exe]

UDP 192.168.0.199:9 *:*

[msnmsgr.exe]

UDP 192.168.0.199:137 *:*

Can not obtain ownership information

UDP 192.168.0.199:138 *:*

Can not obtain ownership information

UDP 192.168.0.199:1900 *:*

SSDPSRV

[svchost.exe]

UDP 192.168.0.199:5353 *:*

[mDNSResponder.exe]

UDP 192.168.0.199:54393 *:*

iphlpsvc

[svchost.exe]

UDP 192.168.0.199:58416 *:*

SSDPSRV

[svchost.exe]

UDP [::]:500 *:*

IKEEXT

[svchost.exe]

UDP [::]:3540 *:*

p2pimsvc

[svchost.exe]

UDP [::]:3702 *:*

FDResPub

[svchost.exe]

UDP [::]:3702 *:*

EventSystem

[svchost.exe]

UDP [::]:3702 *:*

FDResPub

[svchost.exe]

UDP [::]:3702 *:*

EventSystem

[svchost.exe]

UDP [::]:4500 *:*

IKEEXT

[svchost.exe]

UDP [::]:5004 *:*

[wmpnetwk.exe]

UDP [::]:5005 *:*

[wmpnetwk.exe]

UDP [::]:5355 *:*

Dnscache

[svchost.exe]

UDP [::]:52677 *:*

[mDNSResponder.exe]

UDP [::]:52679 *:*

FDResPub

[svchost.exe]

UDP [::]:58413 *:*

EventSystem

[svchost.exe]

UDP [::]:58419 *:*

EventSystem

[svchost.exe]

UDP [::1]:1900 *:*

SSDPSRV

[svchost.exe]

UDP [::1]:58415 *:*

SSDPSRV

[svchost.exe]

UDP [fe80::c096:2dd8:f01f:ab5a%11]:1900 *:*

SSDPSRV

[svchost.exe]

UDP [fe80::c096:2dd8:f01f:ab5a%11]:58414 *:*

SSDPSRV

[svchost.exe]

C:\Users\Biotoxic>

Microsoft Windows [Version 6.1.7600]

Copyright © 2009 Microsoft Corporation. All rights reserved.

C:\Users\Biotoxic>netstat -anb

Active Connections

Proto Local Address Foreign Address State

TCP 0.0.0.0:135 0.0.0.0:0 LISTENING

RpcSs

[svchost.exe]

TCP 0.0.0.0:445 0.0.0.0:0 LISTENING

Can not obtain ownership information

TCP 0.0.0.0:554 0.0.0.0:0 LISTENING

[wmpnetwk.exe]

TCP 0.0.0.0:2869 0.0.0.0:0 LISTENING

Can not obtain ownership information

TCP 0.0.0.0:5357 0.0.0.0:0 LISTENING

Can not obtain ownership information

TCP 0.0.0.0:10243 0.0.0.0:0 LISTENING

Can not obtain ownership information

TCP 0.0.0.0:49152 0.0.0.0:0 LISTENING

[wininit.exe]

TCP 0.0.0.0:49153 0.0.0.0:0 LISTENING

eventlog

[svchost.exe]

TCP 0.0.0.0:49154 0.0.0.0:0 LISTENING

Schedule

[svchost.exe]

TCP 0.0.0.0:49155 0.0.0.0:0 LISTENING

[services.exe]

TCP 0.0.0.0:49157 0.0.0.0:0 LISTENING

[lsass.exe]

TCP 127.0.0.1:5354 0.0.0.0:0 LISTENING

[mDNSResponder.exe]

TCP 127.0.0.1:27015 0.0.0.0:0 LISTENING

[AppleMobileDeviceService.exe]

TCP 127.0.0.1:49158 0.0.0.0:0 LISTENING

[ccSvcHst.exe]

TCP 127.0.0.1:49200 0.0.0.0:0 LISTENING

[msnmsgr.exe]

TCP 127.0.0.1:49200 127.0.0.1:49202 ESTABLISHED

[msnmsgr.exe]

TCP 127.0.0.1:49202 127.0.0.1:49200 ESTABLISHED

[msnmsgr.exe]

TCP 127.0.0.1:49371 127.0.0.1:49372 ESTABLISHED

[firefox.exe]

TCP 127.0.0.1:49372 127.0.0.1:49371 ESTABLISHED

[firefox.exe]

TCP 127.0.0.1:49374 127.0.0.1:49375 ESTABLISHED

[firefox.exe]

TCP 127.0.0.1:49375 127.0.0.1:49374 ESTABLISHED

[firefox.exe]

TCP 192.168.0.199:139 0.0.0.0:0 LISTENING

Can not obtain ownership information

TCP 192.168.0.199:49198 65.54.49.45:1863 ESTABLISHED

[msnmsgr.exe]

TCP 192.168.0.199:49376 74.125.67.104:443 ESTABLISHED

[firefox.exe]

TCP 192.168.0.199:49377 199.7.58.72:80 TIME_WAIT

TCP 192.168.0.199:49379 96.17.106.73:80 ESTABLISHED

[firefox.exe]

TCP 192.168.0.199:49380 96.17.106.73:80 ESTABLISHED

[firefox.exe]

TCP 192.168.0.199:49381 96.17.106.73:80 ESTABLISHED

[firefox.exe]

TCP 192.168.0.199:49382 96.17.106.73:80 ESTABLISHED

[firefox.exe]

TCP 192.168.0.199:49384 96.17.106.90:80 ESTABLISHED

[firefox.exe]

TCP 192.168.0.199:49385 96.17.106.90:80 ESTABLISHED

[firefox.exe]

TCP 192.168.0.199:49386 96.17.106.90:80 ESTABLISHED

[firefox.exe]

TCP 192.168.0.199:49387 96.17.106.90:80 ESTABLISHED

[firefox.exe]

TCP 192.168.0.199:49388 96.17.106.138:80 ESTABLISHED

[firefox.exe]

TCP 192.168.0.199:49389 74.125.67.17:443 ESTABLISHED

[firefox.exe]

TCP 192.168.0.199:49390 76.13.6.132:80 TIME_WAIT

TCP 192.168.0.199:49391 143.127.102.125:80 TIME_WAIT

TCP 192.168.0.199:49392 199.7.58.72:80 TIME_WAIT

TCP 192.168.0.199:49393 96.17.106.88:80 ESTABLISHED

[firefox.exe]

TCP 192.168.0.199:49400 74.125.67.95:80 ESTABLISHED

[firefox.exe]

TCP 192.168.0.199:49401 74.125.67.155:80 ESTABLISHED

[firefox.exe]

TCP 192.168.0.199:49404 208.43.92.218:80 TIME_WAIT

TCP 192.168.0.199:49405 208.43.92.218:80 TIME_WAIT

TCP 192.168.0.199:49406 74.125.67.148:80 ESTABLISHED

[firefox.exe]

TCP 192.168.0.199:49409 208.43.92.218:80 TIME_WAIT

TCP 192.168.0.199:49410 74.125.65.118:80 ESTABLISHED

[firefox.exe]

TCP 192.168.0.199:49411 74.125.45.113:80 ESTABLISHED

[firefox.exe]

TCP 192.168.0.199:49412 96.17.106.67:80 ESTABLISHED

[firefox.exe]

TCP 192.168.0.199:49413 64.124.194.51:80 TIME_WAIT

TCP 192.168.0.199:49414 96.17.106.147:80 ESTABLISHED

[firefox.exe]

TCP 192.168.0.199:49416 206.132.192.198:80 ESTABLISHED

[firefox.exe]

TCP 192.168.0.199:49417 143.127.102.125:80 TIME_WAIT

TCP [::]:135 [::]:0 LISTENING

RpcSs

[svchost.exe]

TCP [::]:445 [::]:0 LISTENING

Can not obtain ownership information

TCP [::]:554 [::]:0 LISTENING

[wmpnetwk.exe]

TCP [::]:2869 [::]:0 LISTENING

Can not obtain ownership information

TCP [::]:3587 [::]:0 LISTENING

p2pimsvc

[svchost.exe]

TCP [::]:5357 [::]:0 LISTENING

Can not obtain ownership information

TCP [::]:10243 [::]:0 LISTENING

Can not obtain ownership information

TCP [::]:49152 [::]:0 LISTENING

[wininit.exe]

TCP [::]:49153 [::]:0 LISTENING

eventlog

[svchost.exe]

TCP [::]:49154 [::]:0 LISTENING

Schedule

[svchost.exe]

TCP [::]:49155 [::]:0 LISTENING

[services.exe]

TCP [::]:49157 [::]:0 LISTENING

[lsass.exe]

TCP [::1]:49159 [::]:0 LISTENING

[ccSvcHst.exe]

UDP 0.0.0.0:500 *:*

IKEEXT

[svchost.exe]

UDP 0.0.0.0:3544 *:*

iphlpsvc

[svchost.exe]

UDP 0.0.0.0:3702 *:*

EventSystem

[svchost.exe]

UDP 0.0.0.0:3702 *:*

EventSystem

[svchost.exe]

UDP 0.0.0.0:3702 *:*

FDResPub

[svchost.exe]

UDP 0.0.0.0:3702 *:*

FDResPub

[svchost.exe]

UDP 0.0.0.0:4500 *:*

IKEEXT

[svchost.exe]

UDP 0.0.0.0:5004 *:*

[wmpnetwk.exe]

UDP 0.0.0.0:5005 *:*

[wmpnetwk.exe]

UDP 0.0.0.0:5355 *:*

Dnscache

[svchost.exe]

UDP 0.0.0.0:52676 *:*

[mDNSResponder.exe]

UDP 0.0.0.0:52678 *:*

FDResPub

[svchost.exe]

UDP 0.0.0.0:53049 *:*

[mDNSResponder.exe]

UDP 0.0.0.0:58412 *:*

EventSystem

[svchost.exe]

UDP 0.0.0.0:58418 *:*

EventSystem

[svchost.exe]

UDP 127.0.0.1:1900 *:*

SSDPSRV

[svchost.exe]

UDP 127.0.0.1:54292 *:*

[msnmsgr.exe]

UDP 127.0.0.1:58417 *:*

SSDPSRV

[svchost.exe]

UDP 127.0.0.1:63184 *:*

[wlcomm.exe]

UDP 192.168.0.199:9 *:*

[msnmsgr.exe]

UDP 192.168.0.199:137 *:*

Can not obtain ownership information

UDP 192.168.0.199:138 *:*

Can not obtain ownership information

UDP 192.168.0.199:1900 *:*

SSDPSRV

[svchost.exe]

UDP 192.168.0.199:5353 *:*

[mDNSResponder.exe]

UDP 192.168.0.199:54393 *:*

iphlpsvc

[svchost.exe]

UDP 192.168.0.199:58416 *:*

SSDPSRV

[svchost.exe]

UDP [::]:500 *:*

IKEEXT

[svchost.exe]

UDP [::]:3540 *:*

p2pimsvc

[svchost.exe]

UDP [::]:3702 *:*

FDResPub

[svchost.exe]

UDP [::]:3702 *:*

EventSystem

[svchost.exe]

UDP [::]:3702 *:*

FDResPub

[svchost.exe]

UDP [::]:3702 *:*

EventSystem

[svchost.exe]

UDP [::]:4500 *:*

IKEEXT

[svchost.exe]

UDP [::]:5004 *:*

[wmpnetwk.exe]

UDP [::]:5005 *:*

[wmpnetwk.exe]

UDP [::]:5355 *:*

Dnscache

[svchost.exe]

UDP [::]:52677 *:*

[mDNSResponder.exe]

UDP [::]:52679 *:*

FDResPub

[svchost.exe]

UDP [::]:58413 *:*

EventSystem

[svchost.exe]

UDP [::]:58419 *:*

EventSystem

[svchost.exe]

UDP [::1]:1900 *:*

SSDPSRV

[svchost.exe]

UDP [::1]:58415 *:*

SSDPSRV

[svchost.exe]

UDP [fe80::c096:2dd8:f01f:ab5a%11]:1900 *:*

SSDPSRV

[svchost.exe]

UDP [fe80::c096:2dd8:f01f:ab5a%11]:58414 *:*

SSDPSRV

[svchost.exe]

C:\Users\Biotoxic>

this is odd

TCP 192.168.0.199:49204 207.46.125.253:7001 TIME_WAIT

TCP 192.168.0.199:49204 207.46.125.254:7001 TIME_WAIT

So how source port is the same going to 2 different IP? thats shouldn't happen?? And then you go the same sort of thing going on here

TCP 127.0.0.1:5357 127.0.0.1:49169 TIME_WAIT

TCP 127.0.0.1:5357 127.0.0.1:49188 TIME_WAIT

Your opening up connection, closing it and then opening up a different connection from the same source port -- and this also in time_wait? Hmmmmm seems strange to be sure, or maybe its just early in the morning?

Anyway -- lets take a look at netstat -s

Im thinking your having lots and lots of errors and retrans on your network?? Also take a look at

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\TcpTimedWaitDelay

What is your setting? is it 30 or 1e in hex Maybe yours is higher??

Also what is on 192.168.0.1 -- not sure why you would be trying to make connections to that on 80 and 9393, is that not your router? Seems odd.

Also do you have TalkSwitch? I see multiple connections to 80, 9393 to your 192.168.0.1?? What is that IP, is that your router? or some kind of pbx box? Not sure why wuauserv would be doing that???

Then you see stuff like this

TCP 192.168.0.199:49404 208.43.92.218:80 TIME_WAIT

TCP 192.168.0.199:49405 208.43.92.218:80 TIME_WAIT

TCP 192.168.0.199:49406 74.125.67.148:80 ESTABLISHED

[firefox.exe]

TCP 192.168.0.199:49409 208.43.92.218:80 TIME_WAIT

Why would firefox be opening up so many connections to the same IP -- since you see lots of them in time_wait means they were opened and then closed and then opened again using a different connection. I do believe the default TcpTimedWaitDelay is 30 seconds.. So you opened up 3 different connections to the same place and then closed them all within 30 seconds? I show that IP as lb2.collective-media.net but can not view it directly.

Be software on your machine checking stuff, your browsing habits? But opening up 3 connections to the same place and then closing them all within 30 seconds seems a bit odd.

How often do you get the error? And Im not sure if its just using all the ports, or see first thing I posted about making a connection to 2 different IPs from the same source port?? That should not happen.

192.168.0.1 is my router, the registry key TcpTimedWaitDelay in non existent in my Windows 7 registry. No pbx box or anything like it connected to my computer. And excuse my ignorance but I have no idea as to what TalkSwitch is.

Here is my netstat -s

Microsoft Windows [Version 6.1.7600]

Copyright © 2009 Microsoft Corporation. All rights reserved.

C:\Users\Biotoxic>netstat -s

IPv4 Statistics

Packets Received = 24045

Received Header Errors = 0

Received Address Errors = 0

Datagrams Forwarded = 0

Unknown Protocols Received = 0

Received Packets Discarded = 2

Received Packets Delivered = 37761

Output Requests = 32838

Routing Discards = 0

Discarded Output Packets = 0

Output Packet No Route = 0

Reassembly Required = 0

Reassembly Successful = 0

Reassembly Failures = 0

Datagrams Successfully Fragmented = 0

Datagrams Failing Fragmentation = 0

Fragments Created = 0

IPv6 Statistics

Packets Received = 3

Received Header Errors = 0

Received Address Errors = 0

Datagrams Forwarded = 0

Unknown Protocols Received = 0

Received Packets Discarded = 0

Received Packets Delivered = 6278

Output Requests = 6426

Routing Discards = 0

Discarded Output Packets = 0

Output Packet No Route = 2

Reassembly Required = 0

Reassembly Successful = 0

Reassembly Failures = 0

Datagrams Successfully Fragmented = 0

Datagrams Failing Fragmentation = 0

Fragments Created = 0

ICMPv4 Statistics

Received Sent

Messages 0 0

Errors 0 0

Destination Unreachable 0 0

Time Exceeded 0 0

Parameter Problems 0 0

Source Quenches 0 0

Redirects 0 0

Echo Replies 0 0

Echos 0 0

Timestamps 0 0

Timestamp Replies 0 0

Address Masks 0 0

Address Mask Replies 0 0

Router Solicitations 0 0

Router Advertisements 0 0

ICMPv6 Statistics

Received Sent

Messages 3 7

Errors 0 0

Destination Unreachable 0 0

Packet Too Big 0 0

Time Exceeded 0 0

Parameter Problems 0 0

Echos 0 0

Echo Replies 0 0

MLD Queries 0 0

MLD Reports 0 0

MLD Dones 0 0

Router Solicitations 0 6

Router Advertisements 3 0

Neighbor Solicitations 0 1

Neighbor Advertisements 0 0

Redirects 0 0

Router Renumberings 0 0

TCP Statistics for IPv4

Active Opens = 1393

Passive Opens = 24

Failed Connection Attempts = 3

Reset Connections = 104

Current Connections = 10

Segments Received = 35730

Segments Sent = 30628

Segments Retransmitted = 114

TCP Statistics for IPv6

Active Opens = 4

Passive Opens = 4

Failed Connection Attempts = 0

Reset Connections = 4

Current Connections = 0

Segments Received = 62

Segments Sent = 62

Segments Retransmitted = 0

UDP Statistics for IPv4

Datagrams Received = 1707

No Ports = 2

Receive Errors = 0

Datagrams Sent = 2050

UDP Statistics for IPv6

Datagrams Received = 4279

No Ports = 0

Receive Errors = 0

Datagrams Sent = 6304

C:\Users\Biotoxic>

Well if 192.168.0.1 is your router -- its makes NO sense why

TCP 192.168.0.199:49175 192.168.0.1:80 TIME_WAIT

TCP 192.168.0.199:49176 192.168.0.1:9393 TIME_WAIT

TCP 192.168.0.199:49206 192.168.0.1:80 TIME_WAIT

TCP 192.168.0.199:49207 192.168.0.1:9393 TIME_WAIT

TCP 192.168.0.199:49208 192.168.0.1:80 TIME_WAIT

TCP 192.168.0.199:49209 192.168.0.1:9393 TIME_WAIT

TCP 192.168.0.199:49210 192.168.0.1:80 TIME_WAIT

TCP 192.168.0.199:49211 192.168.0.1:9393 TIME_WAIT

TCP 192.168.0.199:49221 192.168.0.1:9393 TIME_WAIT

Why would wuauserv and [msnmsgr.exe] be making so many connections to your router on port 8 and 9393???

Ports: 9391-9395 Are unassiged, I found something listing

80,9393 tcp applications TalkSwitch

http://www.talkswitch.com/us/en/

Which is why I asked if you were running something from them.. But it makes NO sense to me why the processes would be talking to your router IP on those ports??

Those stats must of been right after a reboot or you cleared the stats, etc.. Lets see the stats when you get the problem, or after you have been running for a while.

If was me I would run a sniffer and see what the traffic is to your router on that weird port. And why would anything be talking to your router on http (80) either???

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • Good afternoon, I have a customer who purchased a Dell laptop last year. One of the latest Inspirons. they are older so it can be a bit hard to see things on the screen. They are using Windows 11 Home 23H2, I have not upgraded them yet to 24H2. What I did was changed the scaling to 150% and that automatically made all the icons on desktop bigger and using in Chrome webpage elements are bigger etc. The thing is I overlooked the Taskbar and the icons most notably hidden within the arrow pointing up. I though by changing to 150% the scaling even the taskbar would get bigger. Again I don't know how I missed seeing that. Is this something that can be fixed? One other thing is I notice in File Explorer things are also small and not larger after the change. Can this be fixed as well?   Thank You.
    • Apple still has two unannounced features for iOS 26 by Hamid Ganji Apple held its WWDC25 event this month to unveil a slew of AI features and its new design for operating systems, known as Liquid Glass. While iOS 26 currently has no shortage of features, the iPhone maker might still have some features under wraps that didn’t make a debut at this month’s WWDC. Bloomberg’s Mark Gurman writes in his weekly Power On newsletter that Apple didn’t announce two iOS 26 features at the WWDC event. The first feature is a live translation of conversations via AirPods, and the latter is the ability to sync your wireless network login information across devices at a hotel or gym. Even though these features were already tipped to arrive in iOS 26, Apple held them from the event, presumably because they’re still not ready to ship. Apple appears to have learned from its experience with Apple Intelligence and aims to break the habit of unveiling new features before they are ready for release. The Live Translation on iOS 26 is currently integrated with popular apps like Messages, FaceTime, and Phone to help users break language barriers and communicate in different languages. The feature is now under development for AirPods, allowing users to hear real-time speech translations. Moreover, the WiFi syncing feature allows you to sync your sign-in information across your entire Apple ecosystem, enabling you to connect to a public WiFi network with ease. This would eliminate the need to sign into a WiFi network separately on each device. While these features haven’t arrived in iOS 26 yet, they’re more likely to be released later this year, in October or December.
    • Intel Level L4 cache has been around for a long time, so AMD Zen 3D Cache is a copy of Intel L4 cache that was introduced with Broadwell i7-5775c, which had 128mb of Level L4 cache. Secondly, Zen 6 is not faster in single-threaded performance than 13900k/14900k. 285k is something new Intel is trying, basically showing us that chiplet design does not work for gaming, just like AMD design does not work for gaming. Throwing more cores at it and having L4 cache won't fix the issue, and that is frame dip and stuttering caused by a very stupid design decision to keep the memory controller outside the compute tile. Might as well put a memory controller by bringing back a south bridge chip. lol
    • Just like AMD Zen, it is not going to work for gaming despite 3D Cache. Frame dip and stuttering are giving, which renders 14900KS the greatest gaming CPU ever released.
  • Popular Contributors

    1. 1
      +primortal
      519
    2. 2
      +FloatingFatMan
      182
    3. 3
      ATLien_0
      166
    4. 4
      Skyfrog
      99
    5. 5
      Som
      96
  • Tell a friend

    Love Neowin? Tell a friend!