Windows 7 Forums
Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.

Windows 7: Hundreds of TCP - IPv4 loopback connections?

09 Nov 2015   #1

Windows 7 Home 64bit
Hundreds of TCP - IPv4 loopback connections?


Was looking through the resource monitor and noticed I have a large number of TCP Connections going through "IPv4 loopback". It seems to just be going through each port 1 by 1.

Anyone know what's happening here?

My System SpecsSystem Spec
09 Nov 2015   #2

Windows 7 x64 Pro

If I've read correctly, Port 1120 is registered to Battlenet for its Blizzard file transfer function. I've never heard of Battlenet, but I guess it has something to do with online games. And I'm not sure why it has a file transfer function. Maybe for downloading games.

Even so, that doesn't explain why it is opening connections that never leave your PC. If you were to run a NETSTAT command (or use some utility that gives connection status) I suspect you will see these connections are mostly in a Close_Wait or Time_Wait. (I used to live in this stuff, but now I can't remember which is which.) One of them can normally last a long time - like 4 minutes. This is the TCP/IP stack's way of insuring that a port stays unused until there is no chance that a packet from a previous connection between the same two end points will wander in an be accepted as part of a new connection.

This is a normal occurrence, but it can be exploited by malware trying to do a Denial of Service attack. This is pretty unlikely, but I describe it below.

If you have some malware, it could be continually opening and closing connections on your loopback addr (for both source and destination) between port 1120 and an ephemeral port. If is does this very fast it can eat up all your ephemeral ports. They will clear up after the wait period, but if it keeps running it will grab the freed ports as soon as they free up.

This DoS scenario would create thousands, not hundreds, of temporarily unusable ports. A more likely scenario would be some local function needing hundreds of short-lived connections withing your pc to do some legitimate work. (But if it's not Battlenet, it should not be using port 1120.)
My System SpecsSystem Spec
09 Nov 2015   #3

Windows 7 Home 64bit

Quote   Quote: Originally Posted by pokeefe0001 View Post
If I've read correctly, Port 1120 is registered to Battlenet for its Blizzard file transfer function. I've never heard of Battlenet, but I guess it has something to do with online games.
Ah, Blizzard has a app launcher which they use to update and manage their games. If I exit the program the TCP connections stop so I'm guessing it's that, in which case its very unlikely to be malicious.

Thanks for the help. Mystery solved :)
My System SpecsSystem Spec

09 Nov 2015   #4

Windows 7 x64 Pro

Still, hundreds of connections seems odd.
My System SpecsSystem Spec
12 Nov 2015   #5

Microsoft Windows 7 Ultimate 64-bit 7601 Multiprocessor Free Service Pack 1

Sounds like you have many games and applications phoning home
My System SpecsSystem Spec

 Hundreds of TCP - IPv4 loopback connections?

Thread Tools

Similar help and support threads
Thread Forum
Loopback IP address
Hello, I'm new to windows networking and wanted to know if this was possible. I have a laptop with both a wireless and wired connection. I would like use a loopback address so that even if my wired or wireless connection drops other hosts on the network would be able to reach me. I understand...
Network & Sharing
Deleting Hundreds of .PNG files
I have literally many hundreds of .png files that serve no apparent function other than clutter. When I try to delete them the message is, "You require permission from "TrustedInstaller" to make changes to this file". "Unlocker" can delete these files but only one at a time. Is there software out...
General Discussion
host file/ loopback address broken cannot update AV/loginto WLM
Hi guys, this has been going for a couple of days now, I cannot loginto windows live messenger and cannot update my avira free edition anti virus So I tried updating my AV one night and found that I could not - kept coming up with an error... I could browse the web and torrent etc and so I...
Network & Sharing loopback problem / file sharing
Hello. My network consists of one PC and one laptop, both running Vista HP 32 bit and my laptop running Windows 7 HP 64 bit. We can all see each other on the network. The two vista computers can see each others files and also see my shared files. I, however, am unable to access any of their...
Network & Sharing
How to add MS Loopback adapter?
Hi folks! Am in need to add MS loopback adapter. Never did it before in Vista, but in XP I was supposed to use the "Add Hardware Wizard" in Control panel. In Win7, I beleive I have to go into "Devices and Printers" and click on add device, but it dosent work. It keeps searching for devices...
Network & Sharing

Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 05:50.
Twitter Facebook Google+