While browsing the Internet, a computer connects to various network addresses. Sometimes the user has a need to find out with which ip the connection is currently established. This can be done using both the capabilities of the operating system and by installing additional software.
Instructions
Step 1
Usually, the need to look at active connections is associated with a suspicion of a spyware infection on the computer. A properly configured computer should only connect to the network when you open some pages or while updating the OS files and anti-virus program databases. If the network connection indicator in the tray now and then "comes to life" by itself, and the computer, regardless of you, exchanges some information with the Internet, you need to find out the reasons for such network activity.
Step 2
Open a command prompt, to do this, run: "Start" - "All programs" - "Accessories" - "Command line". In the window that opens, enter the command netstat –aon and press Enter. You will see a list of all network connections, active ones will be marked in the "Status" column as ESTABLISHED.
Step 3
Pay attention to the column "External address" - it contains the ip with which your computer was connected, and the connection port. Port 80, for example, is specific to web servers. But if you see any other port, this is already a cause for alarm. In this case, you need to find out which application installed on your computer opens this connection.
Step 4
Look at the last column for the process identifiers (PIDs). Remember the identifier of the suspicious process, then in the same window type the tasklist command. A list of processes running on the computer will open. The first column will contain the names of the processes, the second - their identifiers. Find the identifier of the suspicious process, then, to the left of it, look at the name of the program to which it belongs.
Step 5
What if the process name doesn't tell you anything? Type it in a search engine, and you will receive all the information about this process. If there is no information, then it is very likely that you have "caught" a new Trojan horse, information about which has not yet reached the Internet and anti-virus databases.
Step 6
Pay attention to which port is opening the suspicious process - information about open ports is present in the "Local address" column. Check processes that are pending connection - LISTENING. This is exactly how backdoors behave - Trojans designed to secretly connect to an infected computer. The server part of such a program always "hangs" on some port and waits for a connection from the hacker's computer.
Step 7
For complete control over connections, install the BWMeter program. This is one of the best programs of this class, it will allow you to see which addresses your computer is connected to, it is possible to write information to the log.
