Printable View
The other day I was looking at my Comodo connection and found that at times IE8 had opened up over 50 connections. Anyone else experience this? When I close IE8 and have nothing else open I have 2 outbound system connections (IP is my ISP so prob. for background traffic between my system and my
ISP) and nothing else.
Some sites open up as many as 100 outbound connections and then they fall off in about a few minutes.
Antivir system scan and Sypbot reveal nothing of note.
You could capture the connections and their data with something like Wireshark, then analyze it to figure out what really happening?
Yeah. You should expect this behavior. I suspect, most of these connections are embryonic connections that eventually generate an half-open connection and get then cleaned up by your system. The rest (maybe 20-30%) should be the actual and successful connections established during access to the website, with all its images and other multimedia, ads, client-side scripting, external content and even the website own internal structure having the capacity to generate a sizable number of connections.Quote:
Originally Posted by Bubba
Does IE8 have page prefetching?
Not built-in, I'm sure. Possibly through a plugin. Web prefetch generates security concerns.
As an additional note, the amount of connections established during normal operations with a browser are indeed a way to gauge the possibility of being infected with an hijacker. A careful analysis of the connections being established may indicate for instance if one's connecting to addresses with no relation to the webpage contents. Also, hijackers can open a tremendous number of connections. I just think numbers between 50 and 100 connections, maybe even 150 or 200 for heavyweight pages with lots of content and client-side scripting, are well within normal bounds.
Over 200 Ajax requests per second (or through Flash) or Java applications that are connected to 200 servers simultaneously? I just don't buy it.Quote:
Originally Posted by Mario F.
Turn off Java and Javascript and see what happens then.
I think you missed the part where I talk about half-open connections...
Thing is I've seen those numbers without hijackers, trojans, virus, or even a cold, on the computer.
Half-open connections only make sense if the target server is non-responsive. If a connection stays half-open for more than a second, something is wrong.
Note really. Half-open connections also increase with low quality lines or during peak time. It's a fact, for instance, that before I got a closer telephone exchange to my house some 5 months ago, I had a lot more embryonic connections with a large percentage eventually resulting in half-open connections.
I expect accessing during peak times or accessing servers under heavy load should also result in embryonic connections and eventually half-open connections. Since Bubba is seeing these connections dropping just seconds away from when they were created, it is actually why I think there's not much to worry about.
The system is clean AFAIK. It is not showing symptoms of infection. AntiVir wipes out anything it finds and in my log it has found infected files (mainly Java crap) but it has since removed them.
I really think the connections are just a part of IE8 as my father has the same issue with it and Comodo is reporting just as many connections as my system. On websites that take forever to load once you click the link I notice the number of connections is extremely high for about 1 second and then drops off to about 14 or 15. Also tabbing in IE8 seems to be a serious hack. They usually spawn off a new IE8 process and also come with 20 or 30 connections to start with. After about 1 second the connections fall off but it is still annoying.
After posting on cboard for a bit today and having no other tabs or IE8 windows open there is only 1 outbound connection. The first hit on cboard raises the connection count to around 15 to 20 and then it slowly drops off to 1.
I suspect you are already using windows 7? With windows XP you get a lot less connections because it has a built-in imposed limit of concurrent connections (it pools the remaining ones past this limit). Possibly why this is coming as a shocker to you now :)
No I'm on XP. But IE8 is designed for Vista so the new connection counts have prob. been there since I started using IE8 but didn't notice them until recently.