W7-Internet performance-TCP connections

[babuja]

Hy guys,

i've been experiencing really low internet speed and contacted the internet supplier.

They asked me to introduce in command line a comand to evaluet the TCP connections on my desktop.

I have about 60 TCP connections. The thechnic from the internet supplier told me that this is not normal, that I shouldn't have more that 15 TCP connection (is this true in W7??) and that's spyware connection and the reson I have a low internet speed.

I use malwarebyte and the test is 0 malware.

What should I do?
Use another malware remover?

Thanks

 

[logicearth]

What was the output of the command you used?

 

[oreo27]

Hy guys,

i've been experiencing really low internet speed and contacted the internet supplier.

They asked me to introduce in command line a comand to evaluet the TCP connections on my desktop.

I have about 60 TCP connections. The thechnic from the internet supplier told me that this is not normal, that I shouldn't have more that 15 TCP connection (is this true in W7??) and that's spyware connection and the reson I have a low internet speed.

I use malwarebyte and the test is 0 malware.

What should I do?
Use another malware remover?

Thanks

Hi,

To see all the applications which are currently connected to the Internet, use CurrPorts: Monitoring TCP/IP network connections on Windows. This is pretty intuitive and at least you'll have some idea of the current connections on your PC.

 

[babuja]

netstat -a

What was the output of the command you used?

the comand is: netstat -a

 

[babuja]

Hy guys,

Hi,

To see all the applications which are currently connected to the Internet, use CurrPorts: Monitoring TCP/IP network connections on Windows. This is pretty intuitive and at least you'll have some idea of the current connections on your PC.

I´ll try that...but if I have more than 15 TCP connects I this anormal in W7?

 

[logicearth]

What was the output of the command you used?

the comand is: netstat -a

Right...but what was the output you got from it?
The amount of TCP connections is not worth anything without knowing what is being connected.

 

[oreo27]

Hy guys,

Hi,

To see all the applications which are currently connected to the Internet, use CurrPorts: Monitoring TCP/IP network connections on Windows. This is pretty intuitive and at least you'll have some idea of the current connections on your PC.

I´ll try that...but if I have more than 15 TCP connects I this anormal in W7?

Due to torrenting, I normally have 80 connections at any given time, so it really does depend on the current running applications.

You should try CurrPorts and see what those applications are. If you see something you are sure shouldn't be running, then that might be malware.

However, in my experience, Malwarebytes is pretty good in detecting malware so it might just be an application that is updating or something similar which his slowing down your Internet connection.

 

[babuja]

I don't have any torrent program runing and only using web page surfing.This is the result from comand netstat -a:

C:\Users\CESAR>netstat -a
Active Connections
Proto Local Address Foreign Address State
TCP 0.0.0.0:135 CESAR-PC:0 LISTENING
TCP 0.0.0.0:445 CESAR-PC:0 LISTENING
TCP 0.0.0.0:554 CESAR-PC:0 LISTENING
TCP 0.0.0.0:1110 CESAR-PC:0 LISTENING
TCP 0.0.0.0:2869 CESAR-PC:0 LISTENING
TCP 0.0.0.0:5357 CESAR-PC:0 LISTENING
TCP 0.0.0.0:10243 CESAR-PC:0 LISTENING
TCP 0.0.0.0:17500 CESAR-PC:0 LISTENING
TCP 0.0.0.0:19780 CESAR-PC:0 LISTENING
TCP 0.0.0.0:49152 CESAR-PC:0 LISTENING
TCP 0.0.0.0:49153 CESAR-PC:0 LISTENING
TCP 0.0.0.0:49154 CESAR-PC:0 LISTENING
TCP 0.0.0.0:49157 CESAR-PC:0 LISTENING
TCP 0.0.0.0:49161 CESAR-PC:0 LISTENING
TCP 0.0.0.0:49164 CESAR-PC:0 LISTENING
TCP 0.0.0.0:49172 CESAR-PC:0 LISTENING
TCP 0.0.0.0:49174 CESAR-PC:0 LISTENING
TCP 127.0.0.1:1110 www:49384 ESTABLISHED
TCP 127.0.0.1:1110 www:49440 ESTABLISHED
TCP 127.0.0.1:1110 www:49446 ESTABLISHED
TCP 127.0.0.1:2559 CESAR-PC:0 LISTENING
TCP 127.0.0.1:5939 CESAR-PC:0 LISTENING
TCP 127.0.0.1:9421 CESAR-PC:0 LISTENING
TCP 127.0.0.1:9422 CESAR-PC:0 LISTENING
TCP 127.0.0.1:9423 CESAR-PC:0 LISTENING
TCP 127.0.0.1:19872 www:49169 ESTABLISHED
TCP 127.0.0.1:49155 www:49156 ESTABLISHED
TCP 127.0.0.1:49156 www:49155 ESTABLISHED
TCP 127.0.0.1:49166 CESAR-PC:0 LISTENING
TCP 127.0.0.1:49169 www:19872 ESTABLISHED
TCP 127.0.0.1:49384 www:nfsd-status ESTABLISHED
TCP 127.0.0.1:49438 www:nfsd-status TIME_WAIT
TCP 127.0.0.1:49440 www:nfsd-status ESTABLISHED
TCP 127.0.0.1:49442 www:nfsd-status TIME_WAIT
TCP 127.0.0.1:49443 www:nfsd-status TIME_WAIT
TCP 127.0.0.1:49446 www:nfsd-status ESTABLISHED
TCP 192.168.1.67:139 CESAR-PC:0 LISTENING
TCP 192.168.1.67:49162 209.107.220.180:https ESTABLISHED
TCP 192.168.1.67:49168 www:https CLOSE_WAIT
TCP 192.168.1.67:49170 208:https CLOSE_WAIT
TCP 192.168.1.67:49385 208:http ESTABLISHED
TCP 192.168.1.67:49429 65.55.53.156:https TIME_WAIT
TCP 192.168.1.67:49435 wy-in-f101:http TIME_WAIT
TCP 192.168.1.67:49437 wy-in-f101:http TIME_WAIT
TCP 192.168.1.67:49439 208.94.0.21:http TIME_WAIT
TCP 192.168.1.67:49441 208.94.0.61:http ESTABLISHED
TCP 192.168.1.67:49444 74.125.230.188:http TIME_WAIT
TCP 192.168.1.67:49445 195-23-79-40:http TIME_WAIT
TCP 192.168.1.67:49447 208.94.0.61:http ESTABLISHED
TCP 192.168.1.67:49448 94.75.236.122:http TIME_WAIT
TCP [::]:135 CESAR-PC:0 LISTENING
TCP [::]:445 CESAR-PC:0 LISTENING
TCP [::]:554 CESAR-PC:0 LISTENING
TCP [::]:1110 CESAR-PC:0 LISTENING
TCP [::]:2869 CESAR-PC:0 LISTENING
TCP [::]:5357 CESAR-PC:0 LISTENING
TCP [::]:10243 CESAR-PC:0 LISTENING
TCP [::]:19780 CESAR-PC:0 LISTENING
TCP [::]:49152 CESAR-PC:0 LISTENING
TCP [::]:49153 CESAR-PC:0 LISTENING
TCP [::]:49154 CESAR-PC:0 LISTENING
TCP [::]:49157 CESAR-PC:0 LISTENING
TCP [::]:49161 CESAR-PC:0 LISTENING
TCP [::]:49172 CESAR-PC:0 LISTENING
TCP [::]:49174 CESAR-PC:0 LISTENING
UDP 0.0.0.0:500 *:*
UDP 0.0.0.0:3702 *:*
UDP 0.0.0.0:3702 *:*
UDP 0.0.0.0:4500 *:*
UDP 0.0.0.0:5004 *:*
UDP 0.0.0.0:5005 *:*
UDP 0.0.0.0:5355 *:*
UDP 0.0.0.0:17500 *:*
UDP 0.0.0.0:48000 *:*
UDP 0.0.0.0:49152 *:*
UDP 0.0.0.0:55631 *:*
UDP 0.0.0.0:55632 *:*
UDP 127.0.0.1:1900 *:*
UDP 127.0.0.1:49239 *:*
UDP 127.0.0.1:49240 *:*
UDP 127.0.0.1:53107 *:*
UDP 127.0.0.1:53966 *:*
UDP 127.0.0.1:55629 *:*
UDP 127.0.0.1:55630 *:*
UDP 127.0.0.1:58952 *:*
UDP 127.0.0.1:61882 *:*
UDP 192.168.1.67:137 *:*
UDP 192.168.1.67:138 *:*
UDP 192.168.1.67:1900 *:*
UDP 192.168.1.67:58951 *:*
UDP [::]:500 *:*
UDP [::]:3702 *:*
UDP [::]:3702 *:*
UDP [::]:4500 *:*
UDP [::]:5004 *:*
UDP [::]:5005 *:*
UDP [::]:5355 *:*
UDP [::]:49153 *:*
UDP [::1]:1900 *:*
UDP [::1]:58950 *:*
UDP [fe80::896d:bb5f:e54f:2da7%11]:546 *:*
UDP [fe80::896d:bb5f:e54f:2da7%11]:1900 *:*
UDP [fe80::896d:bb5f:e54f:2da7%11]:58949 *:*
C:\Users\CESAR>

 

[cluberti]

There are a few public http connections in a time_wait state, but there's nothing here that should affect your computer's performance over a network. If you're seeing low performance, check other things like latency and throughput. Using a simple ping test and changing some of the defaults, and a tracert to a well-known site, you can generally get an idea about where the problem lies.

For ping, try this command and paste the output here (if 1460 doesn't work, try 1400, then 1300 if the previous number causes the message "Packet needs to be fragmented but DF set." to be displayed):
ping 74.209.160.12 -n 10 -l 1460 -f

For tracert, try this command and paste the output here:
tracert 74.209.160.12

 

[babuja]

There are a few public http connections in a time_wait state.

What those this mean in simple english for noobie?:sarc:

I'll perfome those test and post results, tnks!

 

[cluberti]

TIME_WAIT means one side has tried to close the connection (usually the client), but the server has not yet responded with an acknowledgement of the close request. These connections will ultimately timeout when the connection times out.

 

[babuja]

For ping, try this command and paste the output here (if 1460 doesn't work, try 1400, then 1300 if the previous number causes the message "Packet needs to be fragmented but DF set." to be displayed):
ping 74.209.160.12 -n 10 -l 1460 -f

Microsoft Windows [Version 6.1.7600]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Users\CESAR>ping 74.209.160.12 -n 10 -l 1460 -f

Pinging 74.209.160.12 with 1460 bytes of data:
Reply from 74.209.160.12: bytes=1460 time=241ms TTL=45
Reply from 74.209.160.12: bytes=1460 time=247ms TTL=45
Reply from 74.209.160.12: bytes=1460 time=256ms TTL=45
Reply from 74.209.160.12: bytes=1460 time=238ms TTL=45
Reply from 74.209.160.12: bytes=1460 time=255ms TTL=45
Reply from 74.209.160.12: bytes=1460 time=242ms TTL=45
Reply from 74.209.160.12: bytes=1460 time=254ms TTL=45
Reply from 74.209.160.12: bytes=1460 time=249ms TTL=45
Reply from 74.209.160.12: bytes=1460 time=254ms TTL=45
Reply from 74.209.160.12: bytes=1460 time=259ms TTL=45

Ping statistics for 74.209.160.12:
Packets: Sent = 10, Received = 10, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 238ms, Maximum = 259ms, Average = 249ms

C:\Users\CESAR>

For tracert, try this command and paste the output here:
tracert 74.209.160.12

Microsoft Windows [Version 6.1.7600]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Users\CESAR>tracert 74.209.160.12

Tracing route to static-74-209-160-12.lynnwood.netriver.net [74.209.160.12]
over a maximum of 30 hops:

1 43 ms 100 ms 196 ms speedtouch.lan [192.168.1.254]
2 25 ms 24 ms 25 ms 194-79-94-17.nr.ip.pt [194.79.94.17]
3 27 ms * * 195.23.196.89
4 24 ms 25 ms 25 ms 195.23.199.145
5 26 ms 25 ms 25 ms 195.23.196.161
6 43 ms 42 ms 41 ms 195-23-15-210.net.novis.pt [195.23.15.210]
7 41 ms 42 ms 41 ms TenGigabitEthernet1-4.ar2.mad1.gblx.net [208.48.
24.1]
8 166 ms 168 ms 167 ms 162.97.118.2
9 526 ms 227 ms 338 ms tg9-2.cr01.chcgildt.integra.net [209.63.114.37]

10 220 ms 321 ms 221 ms tg9-3.cr01.mplsmncd.integra.net [209.63.97.193]

11 219 ms 315 ms 316 ms te9-4.cr02.mplsmncd.integra.net [209.63.98.30]
12 216 ms 216 ms 215 ms tg13-2.cr02.sttlwatw.integra.net [209.63.99.53]

13 216 ms 219 ms 221 ms tg9-1.ar10.tkwlwazs.integra.net [209.63.114.130]

14 239 ms 239 ms 393 ms ge6-1.rtr3.lw.netriver.net [64.122.5.50]
15 231 ms 225 ms 228 ms static-74-209-160-12.lynnwood.netriver.net [74.2
09.160.12]

Trace complete.

C:\Users\CESAR>

The internet service (8Mb) is so slow that to open a webpage like facebook, it takes about 2-3 min.

With the same laptop, in my neighbor house with a servive of 2Mb it takes 5-10 s.

 

[oreo27]

Well, that's simply a problem on the end of your Internet service provider. Explain to them that you tried the same PC on another connection which worked well.

Ask them to send a repair crew to look into it.

 

[Shootist]

Not sure what all those 127.x.x.x connections are but they are not on my PC.
Active Connections

Proto Local Address Foreign Address State
TCP 0.0.0.0:135 i5:0 LISTENING
TCP 0.0.0.0:445 i5:0 LISTENING
TCP 0.0.0.0:3399 i5:0 LISTENING
TCP 0.0.0.0:5357 i5:0 LISTENING
TCP 0.0.0.0:49152 i5:0 LISTENING
TCP 0.0.0.0:49153 i5:0 LISTENING
TCP 0.0.0.0:49154 i5:0 LISTENING
TCP 0.0.0.0:49155 i5:0 LISTENING
TCP 0.0.0.0:49156 i5:0 LISTENING
TCP 0.0.0.0:49157 i5:0 LISTENING
TCP 192.168.1.100:139 i5:0 LISTENING
TCP 192.168.1.100:62019 74.125.229.108:http ESTABLISHED
TCP 192.168.1.100:62083 gw-in-f109op3s TIME_WAIT
TCP [::]:135 i5:0 LISTENING
TCP [::]:445 i5:0 LISTENING
TCP [::]:3392 i5:0 LISTENING
TCP [::]:5357 i5:0 LISTENING
TCP [::]:49152 i5:0 LISTENING
TCP [::]:49153 i5:0 LISTENING
TCP [::]:49154 i5:0 LISTENING
TCP [::]:49155 i5:0 LISTENING
TCP [::]:49156 i5:0 LISTENING
TCP [::]:49157 i5:0 LISTENING
UDP 0.0.0.0:500 *:*
UDP 0.0.0.0:3702 *:*
UDP 0.0.0.0:3702 *:*
UDP 0.0.0.0:4500 *:*
UDP 0.0.0.0:5355 *:*
UDP 0.0.0.0:55982 *:*
UDP 127.0.0.1:57744 *:*
UDP 192.168.1.100:137 *:*
UDP 192.168.1.100:138 *:*
UDP [::]:500 *:*
UDP [::]:3702 *:*
UDP [::]:3702 *:*
UDP [::]:4500 *:*
UDP [::]:5355 *:*
UDP [::]:55983 *:*

 

[cluberti]

The internet service (8Mb) is so slow that to open a webpage like facebook, it takes about 2-3 min.

With the same laptop, in my neighbor house with a servive of 2Mb it takes 5-10 s.

In looking at your ping times and tracert, it does appear that your latencies within your ISPs peer route in the US (integra.net) are really very slow. It would be interesting to see you run a tracert against www. google.com and www. microsoft.com, to see if you also go through those same routes from Portugal into the US.

The fact that the same exact machine on another internet connection doesn't exhibit the symptoms means that it really isn't the machine, it's the network connection (and in this case, it's likely the actual route the packets take that is the problem). High latency means a high likelihood of TCP timeouts, window size shrinkage, TCP resets and packet resends, etc. It can really slow your browsing, much more than having low bandwidth or throughput.

 

[murmatron]

Netstat isn't a useful tool for diagnosing internet speed problems. The number of tcp connections is not a useful metric either. Whoever told you that you had too many tcp connections was either ignorant or making stuff up to fob you off.

On my machine I regularly hit 1000+ tcp connections, most of which will be either internal or half-open and it has no effect whatsoever on the performance of my 2Mb DSL connection.

 

[babuja]

Well, that's simply a problem on the end of your Internet service provider. Explain to them that you tried the same PC on another connection which worked well.

Ask them to send a repair crew to look into it.

Well, that´s the problem. The portuguese internet supplier "Optimus Clix" does send anyone because they say that's not a clix problem but a laptop problem of many TCP connection, and that's spayware "eating"bandwdth...can you believe this guys?

What do you mean by; problem on the end of your internet service provider? Could be router manfunction?

 

[cluberti]

I can believe the people you're talking to at your ISP are script-reading morons, but that's about it .

 

[oreo27]

Well, that's simply a problem on the end of your Internet service provider. Explain to them that you tried the same PC on another connection which worked well.

Ask them to send a repair crew to look into it.

Well, that´s the problem. The portuguese internet supplier "Optimus Clix" does send anyone because they say that's not a clix problem but a laptop problem of many TCP connection, and that's spayware "eating"bandwdth...can you believe this guys?

What do you mean by; problem on the end of your internet service provider? Could be router manfunction?

It means that they aren't giving you the service that you are paying for. Call them up, explain to them that you have tried the same laptop on another Internet connection without any problems.

Tell them to send someone and stop wasting your time. Ask for a supervisor if necessary.

Let us know what happens.

 

[benroy]

In addition, you acquired something on the subject of IPs as well as the potential reasons for networking issues. The fact is that, you can find here a lot more details about IP Address 192.168.l.254 and its particular capabilities, once you search this address through the internet.