What are these LISTENING TCP, UDP programs?

[Keith Snyder]

Executing "netstat -a" after startup but before dialing my ISP
I get the following display:

Active Connections

Proto Local Address Foreign Address State
TCP hazel:epmap 0.0.0.0:0
LISTENING
TCP hazel:microsoft-ds 0.0.0.0:0
LISTENING
TCP hazel:1025 0.0.0.0:0
LISTENING
TCP hazel:1027 0.0.0.0:0
LISTENING
TCP hazel:3001 0.0.0.0:0
LISTENING
TCP hazel:5000 0.0.0.0:0
LISTENING
TCP hazel:3002 0.0.0.0:0
LISTENING
TCP hazel:3003 0.0.0.0:0
LISTENING
TCP hazel:3004 0.0.0.0:0
LISTENING
UDP hazel:epmap *:*
UDP hazel:microsoft-ds *:*
UDP hazel:isakmp *:*
UDP hazel:1026 *:*
UDP hazel:3007 *:*
UDP hazel:ntp *:*
UDP hazel:1900 *:*
UDP hazel:3006 *:*
UDP hazel:29549 *:*

"hazel" is my machine (she was a beloved aunt). What are these
programs and ports, and why are they active and or listening?

--
Keith

[Keith Snyder]

Hmm. I must have asked in the wrong newsgroup.
Can somebody point me to the right one?

Mystery servers listening on my TCP ports make me nervous, so
I want to know what these servers are.

--
Keith

"Keith Snyder" > wrote in message
...
> Executing "netstat -a" after startup but before dialing my
ISP
> I get the following display:
>
> Active Connections
>
> Proto Local Address Foreign Address State
> TCP hazel:epmap 0.0.0.0:0
> LISTENING
> TCP hazel:microsoft-ds 0.0.0.0:0
> LISTENING
> TCP hazel:1025 0.0.0.0:0
> LISTENING
> TCP hazel:1027 0.0.0.0:0
> LISTENING
> TCP hazel:3001 0.0.0.0:0
> LISTENING
> TCP hazel:5000 0.0.0.0:0
> LISTENING
> TCP hazel:3002 0.0.0.0:0
> LISTENING
> TCP hazel:3003 0.0.0.0:0
> LISTENING
> TCP hazel:3004 0.0.0.0:0
> LISTENING
> UDP hazel:epmap *:*
> UDP hazel:microsoft-ds *:*
> UDP hazel:isakmp *:*
> UDP hazel:1026 *:*
> UDP hazel:3007 *:*
> UDP hazel:ntp *:*
> UDP hazel:1900 *:*
> UDP hazel:3006 *:*
> UDP hazel:29549 *:*
>
> "hazel" is my machine (she was a beloved aunt). What are
these
> programs and ports, and why are they active and or
listening?
>
> --
> Keith
>
>

[Ian Clark]

"Keith Snyder" > wrote in message
...
> Hmm. I must have asked in the wrong newsgroup.
> Can somebody point me to the right one?
>
> Mystery servers listening on my TCP ports make me nervous, so
> I want to know what these servers are.
>
> --


Google for a port list. That will tell you what the ports are for.

[Keith Snyder]

"Ian Clark" > wrote in message
...
>
> "Keith Snyder" > wrote in message
> ...
> > Hmm. I must have asked in the wrong newsgroup.
> > Can somebody point me to the right one?
> >
> > Mystery servers listening on my TCP ports make me nervous,
so
> > I want to know what these servers are.
> >
> > --
>
>
> Google for a port list. That will tell you what the ports
are for.

Thanks for the tip.

I just did, and now I'm alarmed. These servers seem to be
built into
XP and run without my say-so. For example, one port is 3100
which
is "listening" and is assigned to opcon-xps. That seems to be
a cross-
platform server for which I have no need.

How do I shut these servers off?

--
Keith

[Sharon F]

On Sat, 17 May 2003 20:10:35 -0500, "Keith Snyder"
> wrote:

>Thanks for the tip.
>
>I just did, and now I'm alarmed. These servers seem to be
>built into
>XP and run without my say-so. For example, one port is 3100
>which
>is "listening" and is assigned to opcon-xps. That seems to be
>a cross-
>platform server for which I have no need.
>
>How do I shut these servers off?

Many of the ports lists I've found only give "guesstimates" of what your
ports are being used by and used for. Use these as guides only.

When you click a button or run an Internet programs, it will request a
port(s) for outgoing requests and a corresponding incoming port(s) will
open for any expected responses. After a bit of time goes by (or the
program is closed) the ports then close again.

If you have XP Pro, after using ipconfig to get a list of ports you can
use tasklist /svc. This gives a list of the active programs and their
PID numbers. Match the PID numbers from each list to get a better idea
about who and what *your* system is communicating with.

Once you have matched the PIDs you'll have a better idea about what's
"listening" and "waiting" and so on. Point is, not all open ports are
bad. Your valid internet and network programs have to have these ports
in order to operate correctly.

Have you checked your firewall at one of the port scanning sites? Are
the results throwing up any alarms? (Be aware that the symantec site
*always* says that you need to buy their product, regardless of what
results it displays for your scan.)

Sharon F
MS MVP [Shell/User]

[Keith Snyder]

Thanks much. I have Home instead of Pro, but I hope I can get
the process IDs anyhow.

--
Keith

"Sharon F" > wrote in message
...
> On Sat, 17 May 2003 20:10:35 -0500, "Keith Snyder"
> > wrote:
>
> >Thanks for the tip.
> >
> >I just did, and now I'm alarmed. These servers seem to be
> >built into
> >XP and run without my say-so. For example, one port is 3100
> >which
> >is "listening" and is assigned to opcon-xps. That seems to
be
> >a cross-
> >platform server for which I have no need.
> >
> >How do I shut these servers off?
>
> Many of the ports lists I've found only give "guesstimates"
of what your
> ports are being used by and used for. Use these as guides
only.
>
> When you click a button or run an Internet programs, it will
request a
> port(s) for outgoing requests and a corresponding incoming
port(s) will
> open for any expected responses. After a bit of time goes by
(or the
> program is closed) the ports then close again.
>
> If you have XP Pro, after using ipconfig to get a list of
ports you can
> use tasklist /svc. This gives a list of the active programs
and their
> PID numbers. Match the PID numbers from each list to get a
better idea
> about who and what *your* system is communicating with.
>
> Once you have matched the PIDs you'll have a better idea
about what's
> "listening" and "waiting" and so on. Point is, not all open
ports are
> bad. Your valid internet and network programs have to have
these ports
> in order to operate correctly.
>
> Have you checked your firewall at one of the port scanning
sites? Are
> the results throwing up any alarms? (Be aware that the
symantec site
> *always* says that you need to buy their product, regardless
of what
> results it displays for your scan.)
>
> Sharon F
> MS MVP [Shell/User]

[David Candy]

The win98 resource kit one works on XP. Download it from
ftp://ftp.microsoft.com/services/technet/samples/ps/win98/reskit/diagnose=
/

It's tlist.exe

--=20
http://www.g2mil.com/Apr2003.htm
http://www.sharpword.com/fascism.htm
---------------------------------------------------------------
David Candy
http://www.mvps.org/serenitymacros
---------------------------------------------------------------
"Keith Snyder" > wrote in message =
...
> Thanks much. I have Home instead of Pro, but I hope I can get
> the process IDs anyhow.
>=20
> --
> Keith
>=20
> "Sharon F" > wrote in message
> ...
> > On Sat, 17 May 2003 20:10:35 -0500, "Keith Snyder"
> > > wrote:
> >
> > >Thanks for the tip.
> > >
> > >I just did, and now I'm alarmed. These servers seem to be
> > >built into
> > >XP and run without my say-so. For example, one port is 3100
> > >which
> > >is "listening" and is assigned to opcon-xps. That seems to
> be
> > >a cross-
> > >platform server for which I have no need.
> > >
> > >How do I shut these servers off?
> >
> > Many of the ports lists I've found only give "guesstimates"
> of what your
> > ports are being used by and used for. Use these as guides
> only.
> >
> > When you click a button or run an Internet programs, it will
> request a
> > port(s) for outgoing requests and a corresponding incoming
> port(s) will
> > open for any expected responses. After a bit of time goes by
> (or the
> > program is closed) the ports then close again.
> >
> > If you have XP Pro, after using ipconfig to get a list of
> ports you can
> > use tasklist /svc. This gives a list of the active programs
> and their
> > PID numbers. Match the PID numbers from each list to get a
> better idea
> > about who and what *your* system is communicating with.
> >
> > Once you have matched the PIDs you'll have a better idea
> about what's
> > "listening" and "waiting" and so on. Point is, not all open
> ports are
> > bad. Your valid internet and network programs have to have
> these ports
> > in order to operate correctly.
> >
> > Have you checked your firewall at one of the port scanning
> sites? Are
> > the results throwing up any alarms? (Be aware that the
> symantec site
> > *always* says that you need to buy their product, regardless
> of what
> > results it displays for your scan.)
> >
> > Sharon F
> > MS MVP [Shell/User]
>=20
>=20