Hi,

I just did a TCP scan and found the following line.

svchost.exe:1028-TCP-home-pc:1082-8.255.65.254:http-ESTABLISHED

svchost.exe has an active connection to IP, 8.255.65.254. Data is being
transferred. I did an IP lookup for the above IP but did the results didn't
make sense.

I use Windows XP (SP2 - complete with all updates as of yesterday). I depend
on ZoneAlarm for AV/FW. Autoupdate for XP & ZA are on.

This could be a false alarm with Windows downloading yet another batch of
updates. Can someone please tell me if this is the case?

Thanks,
Sherry

Search ARIN WHOIS for: 8.255.65.254

OrgName: Level 3 Communications, Inc.
OrgID: LVLT
Address: 1025 Eldorado Blvd.
City: Broomfield
StateProv: CO
PostalCode: 80021
Country: US

NetRange: 8.0.0.0 - 8.255.255.255
CIDR: 8.0.0.0/8
NetName: LVLT-ORG-8-8
NetHandle: NET-8-0-0-0-1
Parent:
NetType: Direct Allocation
NameServer: NS1.LEVEL3.NET
NameServer: NS2.LEVEL3.NET
from...
http://ws.arin.net/whois

Level 3 Communications Inc. introduced an innovative and effective quality
improvement initiative.
Level 3 Communications focused this past year on refining service through a
collaborative and proactive approach. The company leveraged its experienced
staff to develop tools to quickly identify and resolve network issues and
significantly improve overall network reliability for MSN. Level 3
Communications exhibited exemplary business integrity, openness and an
emphasis on customer care.
http://www.microsoft.com/presspass/p...rds2004PR.mspx

About Level 3
http://www.level3.com/about_us/index.html

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In news6B74A1E-8CB5-47BA-B1C7-(E-Mail Removed),
Tom <(E-Mail Removed)> hunted and pecked:
> Hi,
>
> I just did a TCP scan and found the following line.
>
> svchost.exe:1028-TCP-home-pc:1082-8.255.65.254:http-ESTABLISHED
>
> svchost.exe has an active connection to IP, 8.255.65.254. Data is being
> transferred. I did an IP lookup for the above IP but did the results
> didn't make sense.
>
> I use Windows XP (SP2 - complete with all updates as of yesterday). I
> depend on ZoneAlarm for AV/FW. Autoupdate for XP & ZA are on.
>
> This could be a false alarm with Windows downloading yet another batch of
> updates. Can someone please tell me if this is the case?
>
> Thanks,
> Sherry

yes it did.. thanks Wes.
So its XP updating itself..


"Wesley Vogel" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> Search ARIN WHOIS for: 8.255.65.254
>
> OrgName: Level 3 Communications, Inc.
> OrgID: LVLT
> Address: 1025 Eldorado Blvd.
> City: Broomfield
> StateProv: CO
> PostalCode: 80021
> Country: US
>
> NetRange: 8.0.0.0 - 8.255.255.255
> CIDR: 8.0.0.0/8
> NetName: LVLT-ORG-8-8
> NetHandle: NET-8-0-0-0-1
> Parent:
> NetType: Direct Allocation
> NameServer: NS1.LEVEL3.NET
> NameServer: NS2.LEVEL3.NET
> from...
> http://ws.arin.net/whois
>
> Level 3 Communications Inc. introduced an innovative and effective quality
> improvement initiative.
> Level 3 Communications focused this past year on refining service through
> a collaborative and proactive approach. The company leveraged its
> experienced staff to develop tools to quickly identify and resolve network
> issues and significantly improve overall network reliability for MSN.
> Level 3 Communications exhibited exemplary business integrity, openness
> and an emphasis on customer care.
> http://www.microsoft.com/presspass/p...rds2004PR.mspx
>
> About Level 3
> http://www.level3.com/about_us/index.html
>
> --
> Hope this helps. Let us know.
>
> Wes
> MS-MVP Windows Shell/User
>
> In news6B74A1E-8CB5-47BA-B1C7-(E-Mail Removed),
> Tom <(E-Mail Removed)> hunted and pecked:
>> Hi,
>>
>> I just did a TCP scan and found the following line.
>>
>> svchost.exe:1028-TCP-home-pc:1082-8.255.65.254:http-ESTABLISHED
>>
>> svchost.exe has an active connection to IP, 8.255.65.254. Data is being
>> transferred. I did an IP lookup for the above IP but did the results
>> didn't make sense.
>>
>> I use Windows XP (SP2 - complete with all updates as of yesterday). I
>> depend on ZoneAlarm for AV/FW. Autoupdate for XP & ZA are on.
>>
>> This could be a false alarm with Windows downloading yet another batch of
>> updates. Can someone please tell me if this is the case?
>>
>> Thanks,
>> Sherry
>

I honestly do not know, Tom. That was about all that I could find.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In news:eLOL$(E-Mail Removed),
Tom <(E-Mail Removed)> hunted and pecked:
> yes it did.. thanks Wes.
> So its XP updating itself..
>
>
> "Wesley Vogel" <(E-Mail Removed)> wrote in message
> news:(E-Mail Removed)...
>> Search ARIN WHOIS for: 8.255.65.254
>>
>> OrgName: Level 3 Communications, Inc.
>> OrgID: LVLT
>> Address: 1025 Eldorado Blvd.
>> City: Broomfield
>> StateProv: CO
>> PostalCode: 80021
>> Country: US
>>
>> NetRange: 8.0.0.0 - 8.255.255.255
>> CIDR: 8.0.0.0/8
>> NetName: LVLT-ORG-8-8
>> NetHandle: NET-8-0-0-0-1
>> Parent:
>> NetType: Direct Allocation
>> NameServer: NS1.LEVEL3.NET
>> NameServer: NS2.LEVEL3.NET
>> from...
>> http://ws.arin.net/whois
>>
>> Level 3 Communications Inc. introduced an innovative and effective
>> quality improvement initiative.
>> Level 3 Communications focused this past year on refining service through
>> a collaborative and proactive approach. The company leveraged its
>> experienced staff to develop tools to quickly identify and resolve
>> network issues and significantly improve overall network reliability for
>> MSN. Level 3 Communications exhibited exemplary business integrity,
>> openness and an emphasis on customer care.
>> http://www.microsoft.com/presspass/p...rds2004PR.mspx
>>
>> About Level 3
>> http://www.level3.com/about_us/index.html
>>
>> --
>> Hope this helps. Let us know.
>>
>> Wes
>> MS-MVP Windows Shell/User
>>
>> In news6B74A1E-8CB5-47BA-B1C7-(E-Mail Removed),
>> Tom <(E-Mail Removed)> hunted and pecked:
>>> Hi,
>>>
>>> I just did a TCP scan and found the following line.
>>>
>>> svchost.exe:1028-TCP-home-pc:1082-8.255.65.254:http-ESTABLISHED
>>>
>>> svchost.exe has an active connection to IP, 8.255.65.254. Data is being
>>> transferred. I did an IP lookup for the above IP but did the results
>>> didn't make sense.
>>>
>>> I use Windows XP (SP2 - complete with all updates as of yesterday). I
>>> depend on ZoneAlarm for AV/FW. Autoupdate for XP & ZA are on.
>>>
>>> This could be a false alarm with Windows downloading yet another batch
>>> of updates. Can someone please tell me if this is the case?
>>>
>>> Thanks,
>>> Sherry