How do I see what connections are being made?

1

My DDWRT router is showing that my computer has a connection count around 600! The router is at 100% CPU use. How can I see what's making all the connections?

So far, I've opened up Resource Monitor and checked the network tab. I can sort by which program is using the most network bandwidth (Pale Moon browser), but I can't see what's making all of the connections. Or rather, where all the connections are being toward (trying to find what tab must be making all of these connections).

I've also tried netstat -A, but it apparently doesn't show the actual number of connections being made. At least, the list of established connections isn't very long, by any means (like enough to account for the 500+ connections apparently being made.

Coldblackice

Posted 2012-11-10T04:21:59.503

Reputation: 4 774

Some like Wireshark should be able to help.

– Karan – 2012-11-10T14:06:19.090

Sounds like malware at work to me. – Moab – 2012-11-10T15:44:39.970

Uh oh -- I think I might know what it might be. I have a browser open with 100-150 tabs (that's not a typo). My thought was that after letting the browser sit unused for a couple hours, it shouldn't be making/having any connections open, as pages aren't being loaded. BUT, now I'm wondering if it could be that a smattering of webpages have AJAX all over the place, keeping a smorgasbord of "live" connections open... ? – Coldblackice – 2012-11-12T07:53:53.830

I suppose a test is in order -- killing the browser, waiting a bit, and seeing if those connections drop to oblivion. Or perhaps disabling javascript in the browser, and likewise seeing if the connections drop out (while still having all the tabs open). And yet another test, using an extension for Firefox called Bartab that automatically unloads unused pages after a set amount of time. – Coldblackice – 2012-11-12T07:55:31.843

Answers

1

You could try CurrPorts network monitoring software. It list of all currently opened TCP/IP and UDP ports:

screenshot

note:

You might need to run CurrPorts with administrator privileges to get accurate process names.

David L.

Posted 2012-11-10T04:21:59.503

Reputation: 250

1

Agree with David L., CurrPorts is rather useful tool. I also use TCPView from sysinternals.

Wireshark and Microsoft Network Monitor are more advanced tool, but also provide this info.

Do you have utorrent running in the background? If Yes - then limit the max number of simultaneous connections allowed.

Volodymyr M.

Posted 2012-11-10T04:21:59.503

Reputation: 1 428

I do have utorrent running in the background, but without any torrents downloading. (And with none running for at least over an hour or two, to rule out the lingering connections from a torrent). – Coldblackice – 2012-11-12T07:51:17.203

Asked: 2012-11-10T04:21:59.503

Viewed: 211 times

Active: 2012-11-11T17:31:10.650