Why are these IPs doing a TimeWait?

[Harry Avant]

I just ran netstat -a -n and here is a partial list of results.

Port IP Time Wait IP owner
1594 69.26.187.18:80 XEEX-COMMUNICATIONS, Santa
Monica, CA

1644 66.216.44.9:80 WV Fiber, Nashville,
TN

1671 69.26.187.32:80 XEEX

1713 66.150.96.119:80 Feed Burner

1731 76.12.37.226:80 LNH, Newark, DE
(Hostmysite)


Can someone tell me what "Time Wait" means and why are these IP
addresses showing up? I looked them up to find the owners such as XEEX
whom I've never heard of. Do I have a problem with my internet
connection?

Thanks,

Harry

[msg]

Harry Avant wrote:

> I just ran netstat -a -n and here is a partial list of results.
>
> Port IP Time Wait IP owner
> 1594 69.26.187.18:80 XEEX-COMMUNICATIONS, Santa
> Monica, CA
>
> 1644 66.216.44.9:80 WV Fiber, Nashville,
> TN
>
> 1671 69.26.187.32:80 XEEX
>
> 1713 66.150.96.119:80 Feed Burner
>
> 1731 76.12.37.226:80 LNH, Newark, DE
> (Hostmysite)
>
>
> Can someone tell me what "Time Wait" means and why are these IP
> addresses showing up? I looked them up to find the owners such as XEEX
> whom I've never heard of. Do I have a problem with my internet
> connection?
>

All are TCP connections to remote port 80 (http), from your host, awaiting
timeout. Some application on your host (web browser, malware, etc.) made
these connections.

Regards,

Michael

[Harry Avant]

msg <msg@_cybertheque.org_> wrote:

>Harry Avant wrote:
>
>> I just ran netstat -a -n and here is a partial list of results.
>>
>> Port IP Time Wait IP owner
>> 1594 69.26.187.18:80 XEEX-COMMUNICATIONS, Santa
>> Monica, CA
>>
>> 1644 66.216.44.9:80 WV Fiber, Nashville,
>> TN
>>
>> 1671 69.26.187.32:80 XEEX
>>
>> 1713 66.150.96.119:80 Feed Burner
>>
>> 1731 76.12.37.226:80 LNH, Newark, DE
>> (Hostmysite)
>>
>>
>> Can someone tell me what "Time Wait" means and why are these IP
>> addresses showing up? I looked them up to find the owners such as XEEX
>> whom I've never heard of. Do I have a problem with my internet
>> connection?
>>
>
>All are TCP connections to remote port 80 (http), from your host, awaiting
>timeout. Some application on your host (web browser, malware, etc.) made
>these connections.
>
>Regards,
>
>Michael

Well I think I understand. Could this be due to some cookies, like
tracking cookies? I do run antivirus scans and Adaware along with
Spybot once a week.

As I continued to run netstat I got things like:

TCP 192.168.1.100:1737 205.178.187.13:80 ESTABLISHED
(Network Solutiosn)
TCP 192.168.1.100:1738 205.178.187.13:80 ESTABLISHED
TCP 192.168.1.100:1740 70.42.134.12:80 ESTABLISHED
(Internap Network Services)

TCP 192.168.1.100:1745 66.150.96.119:80 ESTABLISHED
TCP 192.168.1.100:1747 66.150.96.119:80 ESTABLISHED
TCP 192.168.1.100:1752 72.247.193.187:443 ESTABLISHED
(Akamai Technologies)
TCP 192.168.1.100:1753 72.247.193.187:443 ESTABLISHED

So may I assume that something did establish these connections, and
if they were not my doing how could I find the cause?

Harry

[zibeli]

msg <msg@_cybertheque.org_> wrote:

>Harry Avant wrote:
>
>> I just ran netstat -a -n and here is a partial list of results.
>>
>> Port IP Time Wait IP owner
>> 1594 69.26.187.18:80 XEEX-COMMUNICATIONS, Santa
>> Monica, CA
>>
>> 1644 66.216.44.9:80 WV Fiber, Nashville,
>> TN
>>
>> 1671 69.26.187.32:80 XEEX
>>
>> 1713 66.150.96.119:80 Feed Burner
>>
>> 1731 76.12.37.226:80 LNH, Newark, DE
>> (Hostmysite)
>>
>>
>> Can someone tell me what "Time Wait" means and why are these IP
>> addresses showing up? I looked them up to find the owners such as XEEX
>> whom I've never heard of. Do I have a problem with my internet
>> connection?
>>
>
>All are TCP connections to remote port 80 (http), from your host, awaiting
>timeout. Some application on your host (web browser, malware, etc.) made
>these connections.
>
>Regards,
>
>Michael

Well I think I understand. Could this be due to some cookies, like
tracking cookies? I do run antivirus scans and Adaware along with
Spybot once a week.

As I continued to run netstat I got things like:

TCP 192.168.1.100:1737 205.178.187.13:80 ESTABLISHED
(Network Solutiosn)
TCP 192.168.1.100:1738 205.178.187.13:80 ESTABLISHED
TCP 192.168.1.100:1740 70.42.134.12:80 ESTABLISHED
(Internap Network Services)

TCP 192.168.1.100:1745 66.150.96.119:80 ESTABLISHED
TCP 192.168.1.100:1747 66.150.96.119:80 ESTABLISHED
TCP 192.168.1.100:1752 72.247.193.187:443 ESTABLISHED
(Akamai Technologies)
TCP 192.168.1.100:1753 72.247.193.187:443 ESTABLISHED

So may I assume that something did establish these connections, and
if they were not my doing how could I find the cause?

Harry

I don't know about the others, but the "Feed Burner" one (66.150.96.119) handles RSS feeds. My browser connects to it to check/get updates to an RSS feed to which I'm subscribed. hth