Why am I getting all these TCP connections from places I don't know.

LessonsLearned
LessonsLearned used Ask the Experts™
on
My computer is running slow and I think it is because of TCP connections coming in to my computer.

See image below.  What can I do to stop this kind of stuff?

TCP Port Connections reported by "netstat -no"
Thanks for your help.
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Dave BaldwinFixer of Problems
Most Valuable Expert 2014
Commented:
Those are IP addresses that you are connecting to with either your web browser or maybe some media program.  What programs did you have open when you did this scan?

74.125.0.0 - 74.125.255.255 is Google.
23.72.0.0 - 23.79.255.255 is the AKAMAI content delivery network.
207.200.0.0 - 207.200.63.255 is OnRamp but I don't know what they do.
66.63.128.0 - 66.63.128.255 is Nethere and I don't know what they do either.

You can look up all the others too.  There is nothing wrong with having all those connections.  They can simply be a result of using your web browser.
bbaoIT Consultant
Commented:
Download and run TCPVIEW from Microsoft to check which program or process is causing most connections.

http://technet.microsoft.com/en-us/sysinternals/bb897437.aspx
JohnBusiness Consultant (Owner)
Most Valuable Expert 2012
Expert of the Year 2018

Commented:
Some of the IP addresses are Onramp (Your ISP maybe) and Akamai (content supplier). It looks (in a brief look) like stuff you asked for.

Do you keep IE open with lots of open tabs?
Ensure you’re charging the right price for your IT

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden using our free interactive tool and use it to determine the right price for your IT services. Start calculating Now!

Sivaraj EssakiLead – IT Infrastructures

Commented:
You can install WireShark a free open source network traffic and port monitoring tool to analyze, Its a real time analyzer.

http://www.wireshark.org/download.html

Regards, Shiva
IT Consultant
Commented:
even if you use NETSTAT only, you may use -o option to display the owning process ID associated with each connection, therefore you can trace back to the process name per ID using Windows Task Manager.
Top Expert 2015

Commented:
Your netstat looks like you use IE to browse the web... Problem is somewhere else.

Author

Commented:
Oh, okay.  So this is normal.  I do use IE and Firefox to browse the web, but I close them when I am finished.   Correct me if I am wrong, but when I close the browsers, shouldn't the tcp connections close as well?
Top Expert 2015

Commented:
TCP stack is expected to keep lingering (kind of not completely closed) connections open for a while after protocol closed locally
bbaoIT Consultant

Commented:
> when I close the browsers, shouldn't the tcp connections close as well?

basically, YES.

technically, you can't see the connections disappear instantly as it may take a while waiting for timeout. Eventually, all connections established by IE will be closed once IE is terminated.
Top Expert 2015
Commented:
No, time_wait connections wait for predefined time so other end has chance to close correctly. They are no more sockets held by a process.

Author

Commented:
Thank you very much.  I now have a better understanding of how this works.
bbaoIT Consultant

Commented:
> No, time_wait connections wait for
predefined time so other end has
chance to close correctly. They are no
more sockets held by a process.

thanks for correcting me.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial