When analyzing system processes using TcpView, it's not uncommon to come across unusual IP addresses that may raise suspicions. In this article, we'll explore how to identify and investigate these weird IPs in the TcpView system process.

To begin, launch the Task Manager by right-clicking on an empty spot in the toolbar at the bottom of the screen or by pressing Ctrl-Alt-Del (Windows XP only). From the Task Manager window, find the application's name associated with a specific port. In this example, we'll assume that the process ID is 2864 and corresponds to port 5190.

Now, let's use netstat to gather more information about this process. The '-n' option instructs netstat to display raw IP addresses rather than attempting to resolve them to their respective domain and host names. This can be particularly useful when analyzing remote connection information.

In addition to the '-n' option, we can also add the '-o' option to display the process ID number or 'PID' of the program using that port. This can help us identify which process is responsible for the unusual IP address activity.

By running netstat with the '-a' option, we can view active network connections and gather more information about the connection's state (for TCP connections) as well as the local and foreign IP addresses involved.

In this example, we've identified a suspicious connection to an Internet server at destination port 5190. While it's not uncommon for legitimate applications to connect to remote servers, having two connections to the same destination port can raise suspicions. As system administrators, it's our job to investigate these unusual IPs and determine whether they pose a security risk.

By following these steps and using TcpView to monitor system processes, we can gain a better understanding of the network activity occurring on our systems and take proactive measures to address potential security threats.

Weird ips in tcpview system process