Prev: Mis-using DNS for solving WWW browser problems.
Next: Outside dns not changin
From: Kat Rabun on 28 Mar 2010 08:08
Is it normal for Firefox to listen on two random TCP ports every time?

Here's what happens ...

Bringing Firefox 3.6.2 freeware up (set by default to a blank page for this
test) on WinXP SP3 with Comodo Internet Security 3.14 firewall freeware
reporting Firefox begins "listening" on TCP port 1570 and 1572.

Closing & opening Firefox again (on a blank page by default), now Firefox
is listening on TCP ports 1577 and 1579.

Closing & reopening, Comodo reports Firefox begins listening on TCP ports
1599 and 1601. Repeating, it's listening on ports 1643 and 1645. Then 1647
and 1649. Then 1651 and 1653. Then 1680 & 1682. Then 1689 & 1691.

Debugging, I bring up IE 8.0 on a blank page, yet I don't see any ports
opened for listening; so it's just Firefox related.

The Firefox Tools->Add-Ons are all set to disable for this test (Adblock
Plus 1.1.3 freeware, Flash Video Resources Downloader 1.0.3 freeware,
Flashblock 1.5.11.2 freeware, Java Console 6.0.18 freeware, Java Quick
Starter 1.0 freeware, Microsoft .NET Framework Assistant 0.0.0 freeware).

Two questions:
Does Firefox open two random ports for listening when you start it on a
blank page?

If not, do you have any suggestions for debugging what these ports are
doing?



From: Kat Rabun on 28 Mar 2010 08:46
On Sun, 28 Mar 2010 12:08:45 +0000 (UTC), Kat Rabun wrote:

> Two questions:
> Does Firefox open two random ports for listening when you start it on a
> blank page?

Rebooting, and opening Firefox to a blank page by default, it starts at
1025 and 1027. Restart Firefox and it goes to 1030 & 1032. Then 1036 &
1038. Then 1040 & 1042. Then 1044 & 1046. And so on.

Netstat reports which process is opening the suspect ports:
C:\Documents and Settings\kathleen> netstat -o

Active Connections

Proto Local Address Foreign Address State PID
TCP Kat:1044 localhost:1045 ESTABLISHED 2972
TCP Kat:1045 localhost:1044 ESTABLISHED 2972
TCP Kat:1046 localhost:1047 ESTABLISHED 2972
TCP Kat:1047 localhost:1046 ESTABLISHED 2972

Process explorer freeware reports process 2972 is Firefox.exe.

Googling, I see Firefox sometimes does a loopback to 127.0.0.1
(https://bugzilla.mozilla.org/show_bug.cgi?id=100154) but I don't see any
indication in the netstat that this problem is the same as that known
Firefox bug.

Do you get two ports opened for listening when you open Firefox on Winxp?

From: Kat Rabun on 28 Mar 2010 09:03
On Sun, 28 Mar 2010 12:46:37 +0000 (UTC), Kat Rabun wrote:

> Do you get two ports opened for listening when you open Firefox on Winxp?

As a sanity check, Firefox Tools->Options->Advanced->Update is completely
turned off (none of the three options are checked, Firefox, Add-Ons, &
Search Engines).

Also "Live Bookmarks" & RSS feeds were long ago disabled using
"about:config" and then right clicking reset on "browser.feeds.handler"
which is set to "ask".

Also, for this test, the Firefox Anti-phishing and Anti-malware list
updating was turned off. (Tools->Options->Security->Block reported web
forgeries and Tools->Options->Security->Block reported attack sites).

And, for this test, Firefox link prefetching was also turned off in
"about:config" by setting "network.prefetch-next" to "false".

Still, Firefox opens two ports each time it opens.

Does your firefox open two ports for listening when it opens up?
From: Kat Rabun on 28 Mar 2010 09:11
On Sun, 28 Mar 2010 13:03:39 +0000 (UTC), Kat Rabun wrote:

> Does your firefox open two ports for listening when it opens up?

Searching for all the things that Firefox could be doing, for this test, I
disabled "Extension blocklist updating" in "about:config" by setting
"extensions.blocklist.enabled" to "false".

Also, for this test, I disabled "Live title updating" in "about:config" by
setting "browser.microsummary.enabled" to "false".

As a sanity check, I have no downloads that could be restarting ... so, I
wonder ... am I infected with malware?

Yet, Firefox still opens two outbound TCP port connections for listening.

Do you have any suggestions to help me debug why Firefox opens up two ports
for listening every time it opens up?
From: Kat Rabun on 28 Mar 2010 09:26
> Bringing Firefox 3.6.2 freeware up (set by default to a blank page for this
> test) on WinXP SP3 with Comodo Internet Security 3.14 firewall freeware
> reporting Firefox begins "listening" on TCP port 1570 and 1572.
>
> Closing & opening Firefox again (on a blank page by default), now Firefox
> is listening on TCP ports 1577 and 1579.
>
> Closing & reopening, Comodo reports Firefox begins listening on TCP ports
> 1599 and 1601. Repeating, it's listening on ports 1643 and 1645. Then 1647
> and 1649. Then 1651 and 1653. Then 1680 & 1682. Then 1689 & 1691.

After disabling everything I could think of which might make Firefox open a
port connection, I even started Firefox 3.6.2 in safe mode using:

Start->Run->firefox -safe-mode

With nothing checked in the resulting form, I then pressed "Continue in
safe mode".

Comodo and netstat still reported Firefox (process ID 3120 in this case),
opened up two ports for listening:

C:\Documents and Settings\kathleen>netstat -o

Active Connections

Proto Local Address Foreign Address State PID
TCP Kat:1386 localhost:1387 ESTABLISHED 3120
TCP Kat:1387 localhost:1386 ESTABLISHED 3120
TCP Kat:1388 localhost:1389 ESTABLISHED 3120
TCP Kat:1389 localhost:1388 ESTABLISHED 3120

Likewise, Comodo reported Firefox opened TCP ports 1386 and 1388 for
listening in this test.

Why is Firefox 3.6.2 always opening two ports for listening every time it
opens up?


 |  Next  |  Last
Pages: 1 2 3 4
Prev: Mis-using DNS for solving WWW browser problems.
Next: Outside dns not changin