Firewall now has numerous ports???

[Rob Milligan]

My ICF on XP show about nine ports. My current problem
is huge network bottleneck coming from somewhere. Did
something infiltrate my (er, static) IP address during
the four hours I turned off the ICF for testing?
Presently, all email and internet has slowed to a crawl
on only this PC, all others are fine.

 

[Steven L Umbach]

Where are you getting information about XP ICF showing nine ports? You
certainly could have suffered some sort of attack connected to the internet
for four hours unprotected. If you have other computers, it is a good idea
to use a device at the perimiter also. You can buy a cable/dsl router for as
little as $19 after rebates at Best buy. If the other computers are like
configured, you could use netstat -ano to compare network processes
connected/listening. I also like Tcpview which is free from Sysinternals
which is compact and can show you detailed information on network processes,
mapping to the executable path and allow you to kill any process you see.
Task Manager may be also helpful in determining a process hogging the CPU
and of course you should scan for viruses/worms/trojans/parasites anytime
you experience poor performance. --- Steve

http://www.sysinternals.com/ntw2k/source/tcpview.shtml

 

[Guest]

-----Original Message-----
Where are you getting information about XP ICF showing nine ports? You
certainly could have suffered some sort of attack connected to the internet
for four hours unprotected. If you have other computers, it is a good idea
to use a device at the perimiter also. You can buy a cable/dsl router for as
little as $19 after rebates at Best buy. If the other computers are like
configured, you could use netstat -ano to compare network processes
connected/listening. I also like Tcpview which is free from Sysinternals
which is compact and can show you detailed information on network processes,
mapping to the executable path and allow you to kill any process you see.
Task Manager may be also helpful in determining a process hogging the CPU
and of course you should scan for

viruses/worms/trojans/parasites anytime

you experience poor performance. --- Steve

http://www.sysinternals.com/ntw2k/source/tcpview.shtml

Thank for these tips. By viewing the ICF settings, you
can control what ports are monitored by ICF. There I
discovered all these additional ports, named msmsg.<port
number>. Using System Restore I rolled back to a week
ago and those ports are gone, but there is still a huge
bottleneck. Just now, whilst trying to figure out why
Outlook times out every other message, etc., I discovered
when viewing the "View Network Connections" that in
addition to my "Local Area Connection", "Internet
Gateway" was above this, actively funneling tons of
packets. My next move is to download your recommended TCP
checker. Also, I did just hook up the D-Link DI-604
Router/Firewall to give it a test, but what I describe
above is occuring after this firewall was placed in
front, so something else still happening. Lastly, I ran
a Norton AV 2004 total drives inspection and it came up
empty. Any other thoughts? Can I return a favor? Rob

 

[David Beder [MSFT]]

it sounds like you've got one of the various messenger services running (or
had run at some point). SharedAccess aware applications can dynamically add
themselves to the ports list. such applications also might require using
dynamically allocated port numbers or otherwise have a set of backup ports
used should another application be using the port it wants. as such, each
time the port number changes, the application needs to add a new entry into
the list.

it sounds like you've got ICS turned on as well somewhere on your network. I
don't know that technology well enough to know whether the statistics your
seeing for "funneling packets" is in relation to work your computer is
actually doing or whether it's getting the statistics of work done by the
gateway machine.

is there a specific application showing up in task manager that seems to be
eating up more resources than expected? at a command prompt see whether
"netstat -e" has any interesting info like large numbers of dropped or
errored packets or maybe just inappropriate numbers of outgoing packets. I'd
also try using the tracert command and seeing if packets seem to be getting
routed in a slow fashion like to the ICS box rather than straight to
destination.