netstat and ports 1

[Noip]

1.How do know about whether the connection established as viewed in netstat in inbound or outbound...
2.How to close unwanted connections....
3.Why do I have so much of listening ports which does not seem to belong to the services in use i.e 3500 and above...

I know I'm posting a lot of questions but I think I've got a trojan on my server box.

I'VE already ran Swatit and Trojan remover 4.90
Box: win2k server SP2 with ISA/NAVCE7.6 running

 

[gurner]

Sysinternals do an excellant little program called TCPview

http://www.sysinternals.com

It dynamically displays port activity as it happens.

The initial call by a machine is made via the well known port numbers (80, 21, e.t.c.) into a recieving machine which then in turn instucts the contacting machine to move upto a higher range of ports for continued communication.

TCP does this exchange *primarily*, it is the RPC (Remote Procedure Call) on the recieving machine that sends a reply back and watching it in TCPview is fasinating.

UDP however is like a bull in a china shop and goes blundering *generally* to which ever port it has been told to by an Application.

The port numbers are divided into three ranges: the Well Known Ports, the Registered Ports, and the Dynamic and/or Private Ports.

The Well Known Ports are those from 0 through 1023.

The Registered Ports are those from 1024 through 49151

(RFC text)

The Dynamic and/or Private Ports are those from 49152 through 65535

Ports are used in the TCP [RFC793] to name the ends of logical connections which carry long term conversations. For the purpose of providing services to unknown callers, a service contact port is defined (the ones you know, port 80, 21 e.t.c.).

This list specifies the port used by the server process as its contact port, where the first call is made.

The contact port is sometimes called the "well-known port".

 

[Noip]

Thanx for your post Girth,
it was quite helpful but a little too technical for me. I will give Tcpview a try.