# netstat saying connection established



## samir28nov (Jan 7, 2013)

hi,
i'm facing a problem of slow net speed. wen i called to helpline of my ISP they told me to check netstat -n in cmd. i checked and they told me dat i am facing some hacker problem due to which my net speed is slow.
the result of netstat -n are below


Active Connections

Proto Local Address Foreign Address State
TCP 192.168.0.33:56906 173.194.66.95:443 ESTABLISHED
TCP 192.168.0.33:56907 173.194.39.36:443 ESTABLISHED
TCP 192.168.0.33:56908 54.245.244.59:80 ESTABLISHED
TCP 192.168.0.33:56909 54.245.244.59:80 TIME_WAIT
TCP 192.168.0.33:56910 54.245.244.59:80 TIME_WAIT
TCP 192.168.0.33:56911 216.137.57.137:80 TIME_WAIT
TCP 192.168.0.33:56912 216.137.57.137:80 TIME_WAIT
TCP 192.168.0.33:56913 216.137.57.137:80 TIME_WAIT
TCP 192.168.0.33:56914 173.194.39.48:80 TIME_WAIT
TCP 192.168.0.33:56915 173.194.39.48:80 TIME_WAIT
TCP 192.168.0.33:56916 173.194.39.48:80 TIME_WAIT
TCP 192.168.0.33:56923 46.51.184.240:80 ESTABLISHED
TCP 192.168.0.33:56924 46.51.184.240:80 TIME_WAIT
TCP 192.168.0.33:56925 46.51.184.240:80 TIME_WAIT
TCP 192.168.0.33:56926 173.194.39.57:80 ESTABLISHED
TCP 192.168.0.33:56927 173.194.39.57:80 ESTABLISHED
TCP 192.168.0.33:56928 173.194.39.57:80 ESTABLISHED
TCP 192.168.0.33:56929 54.240.172.90:80 ESTABLISHED
TCP 192.168.0.33:56930 54.240.172.90:80 TIME_WAIT
TCP 192.168.0.33:56931 54.240.172.90:80 TIME_WAIT
TCP 192.168.0.33:56932 173.194.39.57:80 TIME_WAIT
TCP 192.168.0.33:56933 173.194.39.57:80 TIME_WAIT
TCP 192.168.0.33:56934 173.194.39.57:80 TIME_WAIT
TCP 192.168.0.33:56935 173.194.39.45:80 ESTABLISHED
TCP 192.168.0.33:56936 173.194.39.45:80 ESTABLISHED
TCP 192.168.0.33:56937 173.194.39.45:80 ESTABLISHED
TCP 192.168.0.33:56938 173.194.39.36:80 ESTABLISHED
TCP 192.168.0.33:56939 173.194.39.36:80 TIME_WAIT
TCP 192.168.0.33:56940 173.194.39.36:80 TIME_WAIT
TCP 192.168.0.33:56941 173.194.39.48:443 ESTABLISHED
TCP 192.168.0.33:56942 31.186.225.25:80 TIME_WAIT
TCP 192.168.0.33:56943 69.25.24.26:80 ESTABLISHED
TCP 192.168.0.33:56944 69.25.24.26:80 ESTABLISHED
TCP 192.168.0.33:56946 79.140.94.216:80 ESTABLISHED
TCP 192.168.0.33:56950 79.140.95.169:80 ESTABLISHED
TCP 192.168.0.33:56951 79.140.95.169:80 ESTABLISHED
TCP 192.168.0.33:56952 79.140.95.169:80 TIME_WAIT
TCP 192.168.0.33:56953 31.186.225.23:80 ESTABLISHED
TCP 192.168.0.33:56954 31.186.225.23:80 ESTABLISHED
TCP 192.168.0.33:56955 31.186.225.23:80 TIME_WAIT
TCP 192.168.0.33:56956 79.140.95.155:80 TIME_WAIT
TCP 192.168.0.33:56957 79.140.95.155:80 TIME_WAIT
TCP 192.168.0.33:56958 79.140.95.155:80 TIME_WAIT
TCP 192.168.0.33:56962 23.21.90.50:80 TIME_WAIT
TCP 192.168.0.33:56963 23.21.90.50:80 TIME_WAIT
TCP 192.168.0.33:56964 23.21.90.50:80 TIME_WAIT
TCP 192.168.0.33:56967 79.140.95.123:80 TIME_WAIT
TCP 192.168.0.33:56968 79.140.95.123:80 TIME_WAIT
TCP 192.168.0.33:56969 79.140.95.123:80 TIME_WAIT
TCP 192.168.0.33:56970 2.19.18.77:80 TIME_WAIT
TCP 192.168.0.33:56971 2.19.18.77:80 TIME_WAIT
TCP 192.168.0.33:56974 173.194.39.58:80 ESTABLISHED
TCP 192.168.0.33:56975 173.194.39.58:80 TIME_WAIT
TCP 192.168.0.33:56976 173.194.39.58:80 TIME_WAIT
TCP 192.168.0.33:56977 23.62.98.112:80 ESTABLISHED
TCP 192.168.0.33:56978 23.62.98.112:80 ESTABLISHED
TCP 192.168.0.33:56979 23.62.98.112:80 TIME_WAIT
TCP 192.168.0.33:56980 31.13.70.23:80 ESTABLISHED
TCP 192.168.0.33:56982 64.13.137.78:80 ESTABLISHED
TCP 192.168.0.33:56983 64.13.137.78:80 TIME_WAIT
TCP 192.168.0.33:56991 173.194.39.47:443 ESTABLISHED
TCP 192.168.0.33:56992 79.140.94.216:80 TIME_WAIT
TCP 192.168.0.33:56993 79.140.95.145:80 ESTABLISHED
TCP 192.168.0.33:56994 79.140.95.145:80 ESTABLISHED
TCP 192.168.0.33:56995 54.245.243.86:80 ESTABLISHED
TCP 192.168.0.33:56996 54.245.243.86:80 TIME_WAIT
TCP 192.168.0.33:56997 74.125.132.95:80 ESTABLISHED
TCP 192.168.0.33:56998 74.125.132.95:80 ESTABLISHED
TCP 192.168.0.33:56999 67.223.104.26:80 ESTABLISHED
TCP 192.168.0.33:57000 31.186.225.25:80 TIME_WAIT
TCP 192.168.0.33:57001 31.186.225.25:80 TIME_WAIT
TCP 192.168.0.33:57002 79.140.94.216:80 ESTABLISHED
TCP 192.168.0.33:57003 79.140.95.145:80 TIME_WAIT
TCP 192.168.0.33:57004 173.194.39.57:80 TIME_WAIT
TCP 192.168.0.33:57005 69.25.24.26:80 ESTABLISHED
TCP 192.168.0.33:57006 79.140.95.155:80 TIME_WAIT
TCP 192.168.0.33:57007 173.194.39.45:80 ESTABLISHED
TCP 192.168.0.33:57008 173.194.39.45:80 ESTABLISHED
TCP 192.168.0.33:57014 173.193.180.46:80 TIME_WAIT
TCP 192.168.0.33:57015 79.140.95.144:80 TIME_WAIT
TCP 192.168.0.33:57016 79.140.95.144:80 TIME_WAIT
TCP 192.168.0.33:57017 79.140.95.144:80 TIME_WAIT
TCP 192.168.0.33:57020 31.186.225.23:80 ESTABLISHED
TCP 192.168.0.33:57023 79.140.95.169:80 ESTABLISHED
TCP 192.168.0.33:57033 79.140.95.155:80 TIME_WAIT
TCP 192.168.0.33:57034 79.140.94.216:80 ESTABLISHED
TCP 192.168.0.33:57035 79.140.94.216:80 ESTABLISHED
TCP 192.168.0.33:57036 79.140.94.216:80 ESTABLISHED
TCP 192.168.0.33:57037 69.25.24.26:80 TIME_WAIT
TCP 192.168.0.33:57038 79.140.95.136:80 TIME_WAIT
TCP 192.168.0.33:57039 79.140.95.136:80 TIME_WAIT

i red the related Questions on ur forum bt i did't help me.. so kindly if u can help me on this regard as i think u may know my prob as it is not new to u..

thankx

Amir Fida


----------



## Wand3r3r (Sep 17, 2010)

Since they are not all going to the same internet ip address I would say the ISP tech was just getting you off the phone.

If concerned about hackers, virus's and malware visit our virus/trojan/spyware help forum
Virus/Trojan/Spyware Help - Tech Support Forum

In the meantime reboot and come up in safe mode and do the netstat command again. Do you see the same results?


----------



## epshatto (Dec 23, 2010)

You can use the ARIN database to find information about IP addresses that you have questions about.

You could also use the nslookup [IP] command.

For example, suppose you type *nslookup 173.194.66.95*

You get this as part of the output:

*Name: we-in-f95.1e100.net*
*Address: 173.194.66.95*

Oh no! I don't recognize that host, who is connected to my computer?

So, you go to the ARIN database here -

https://www.arin.net/

And in the top right corner you enter the IP address 173.194.66.95

You get this output-

NetRange 173.194.0.0 - 173.194.255.255
CIDR 173.194.0.0/16
Name GOOGLE
Handle NET-173-194-0-0-1
Parent NET173 (NET-173-0-0-0-0) 
Net Type Direct Allocation
Origin AS AS15169
Organization Google Inc. (GOGL) 
Registration Date 2009-08-17 
Last Updated 2012-02-24

Oh. So it's just Google.

It's a port 443 connection which implies HTTPS. So at a guess I'd say you have a Gmail account.

You can use that process to investigate mysterious IP addresses and hosts that show up in your netstat, if you're concerned about them.


----------



## samir28nov (Jan 7, 2013)

hi...currently in my net stat one ip is appearing alot which is 194.144.116.81 so i checked it on www.arin.net and the results are;


Network
NetRange	194.0.0.0 - 194.255.255.255
CIDR	194.0.0.0/8
Name	RIPE-CBLK2
Handle	NET-194-0-0-0-1
Parent	
Net Type	Allocated to RIPE NCC
Origin AS	
Organization	RIPE Network Coordination Centre (RIPE)
Registration Date	1993-07-21
Last Updated	2009-03-25
Comments	These addresses have been further assigned to users in
the RIPE NCC region. Contact information can be found in
the RIPE database at Database Query
RESTful Link	http://whois.arin.net/rest/net/NET-194-0-0-0-1
See Also	Related organization's POC records.
See Also	Related delegations.


i dont know an thing abt "RIPE-CBLK2" and had no connection den y its ip is appearing in my netstat..


----------



## Wand3r3r (Sep 17, 2010)

Software on your pc opens the ports. Did you follow the advice in post #2?


----------

