IE and ports

[raiderfan]

So I was talking to this guy today who was saying that he has windows xp with a firewall (forget which one). He said that when he opens up IE, everytime he goes to a different web site it shows it going to a different port. He tried closing down all ports accept a handful, IE would not display a web page after browsing for a short while. He would reboot and same thing - browse a couple sites then unavailable. Does this make any sense, it didnt to me. The thing is he wanted it more secure than that. Any info please, enlighten me.

[HackinCowboy]

If you're just simply browsing a web page then Port 80 is the only one that should be open. I'm not sure why any other ports would be used at the time unless they were for a different program. Here (http://www.iss.net/security_center/advice/Exploits/Ports/) is a list of some commonly used ports.

[raiderfan]

Thats what I thought. The only thing I could think of is the firewall he is running is not giving correct info. about his ports

[HackinCowboy]

Is he running the firewall that comes with XP? It can be any number of explanations. If he has his e-mail program open, if he has something like KaZaa or another P2P program. Also, Windows XP is loaded with spyware, so it could easily be any one of those programs sending or receiving information.

[Statica]

Does his ISP have a proxy server configured? It could be set wrong. Try disabling the proxy

[DilLy]

Does anyone remember the console command in XPhome for seeing used ports?

[Christoph]

Go to a DOS prompt:

netstat -n

Is it that what you are looking for?

Christoph

[raiderfan]

It wasent XP firewall that he was using. But I found out a lot of software firewalls will constantly switch to different ports so it can not be as easily found.

[TheOldMan]

raiderfan,

Don't mix up source and destination ports.

When you browse a web page, IE opens a random/ephemeral port with a destination of port 80 on the web server. Could also be port 8080 on unix servers or some other port depending on addressing conventions.

If you do the netstat, you might see something like:

Proto Local Address Foreign Address State
TCP 192.168.xx.xx:4164 216.92.61.69:80 LAST_ACK

Switching ports is just the nature of the beast. It's random.

The Old Man

[DilLy]

thx Christoph

now, does anyone know of a web page that lists the various console commands for XP? (just for future reference)

[HackinCowboy]

Here (http://www.computerhope.com/msdos.htm) is a page that lists a large number of DOS commands.