Windows 7 Forums

Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: Hundreds of TCP - IPv4 loopback connections?

09 Nov 2015   #1
nums

Windows 7 Home 64bit
 
 
Hundreds of TCP - IPv4 loopback connections?

Heya,

Was looking through the resource monitor and noticed I have a large number of TCP Connections going through "IPv4 loopback". It seems to just be going through each port 1 by 1.


https://i.imgur.com/M3VHjcx.png

Anyone know what's happening here?


My System SpecsSystem Spec
.
09 Nov 2015   #2
pokeefe0001

Windows 7 x64 Pro
 
 

If I've read correctly, Port 1120 is registered to Battlenet for its Blizzard file transfer function. I've never heard of Battlenet, but I guess it has something to do with online games. And I'm not sure why it has a file transfer function. Maybe for downloading games.

Even so, that doesn't explain why it is opening connections that never leave your PC. If you were to run a NETSTAT command (or use some utility that gives connection status) I suspect you will see these connections are mostly in a Close_Wait or Time_Wait. (I used to live in this stuff, but now I can't remember which is which.) One of them can normally last a long time - like 4 minutes. This is the TCP/IP stack's way of insuring that a port stays unused until there is no chance that a packet from a previous connection between the same two end points will wander in an be accepted as part of a new connection.

This is a normal occurrence, but it can be exploited by malware trying to do a Denial of Service attack. This is pretty unlikely, but I describe it below.

If you have some malware, it could be continually opening and closing connections on your loopback addr (for both source and destination) between port 1120 and an ephemeral port. If is does this very fast it can eat up all your ephemeral ports. They will clear up after the wait period, but if it keeps running it will grab the freed ports as soon as they free up.

This DoS scenario would create thousands, not hundreds, of temporarily unusable ports. A more likely scenario would be some local function needing hundreds of short-lived connections withing your pc to do some legitimate work. (But if it's not Battlenet, it should not be using port 1120.)
My System SpecsSystem Spec
09 Nov 2015   #3
nums

Windows 7 Home 64bit
 
 

Quote   Quote: Originally Posted by pokeefe0001 View Post
If I've read correctly, Port 1120 is registered to Battlenet for its Blizzard file transfer function. I've never heard of Battlenet, but I guess it has something to do with online games.
Ah, Blizzard has a battle.net app launcher which they use to update and manage their games. If I exit the program the TCP connections stop so I'm guessing it's that, in which case its very unlikely to be malicious.

Thanks for the help. Mystery solved
My System SpecsSystem Spec
.

09 Nov 2015   #4
pokeefe0001

Windows 7 x64 Pro
 
 

Still, hundreds of connections seems odd.
My System SpecsSystem Spec
12 Nov 2015   #5
cyclops

Microsoft Windows 7 Ultimate 64-bit 7601 Multiprocessor Free Service Pack 1
 
 

Sounds like you have many games and applications phoning home
My System SpecsSystem Spec
Reply

 Hundreds of TCP - IPv4 loopback connections?




Thread Tools Search this Thread
Search this Thread:

Advanced Search




Similar help and support threads
Thread Forum
Loopback IP address
Hello, I'm new to windows networking and wanted to know if this was possible. I have a laptop with both a wireless and wired connection. I would like use a loopback address so that even if my wired or wireless connection drops other hosts on the network would be able to reach me. I understand...
Network & Sharing
host file/ loopback address broken cannot update AV/loginto WLM
Hi guys, this has been going for a couple of days now, I cannot loginto windows live messenger and cannot update my avira free edition anti virus So I tried updating my AV one night and found that I could not - kept coming up with an error... I could browse the web and torrent etc and so I...
Network & Sharing
127.0.0.1 loopback problem / file sharing
Hello. My network consists of one PC and one laptop, both running Vista HP 32 bit and my laptop running Windows 7 HP 64 bit. We can all see each other on the network. The two vista computers can see each others files and also see my shared files. I, however, am unable to access any of their...
Network & Sharing
How to add MS Loopback adapter?
Hi folks! Am in need to add MS loopback adapter. Never did it before in Vista, but in XP I was supposed to use the "Add Hardware Wizard" in Control panel. In Win7, I beleive I have to go into "Devices and Printers" and click on add device, but it dosent work. It keeps searching for devices...
Network & Sharing


Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 17:53.

Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App