Is this a sign of network attack? Since I don't remember using any service that would need a tcp connection from the same subnet. Where can I find the logs for these connections, e.g., who initialized the connections and how they are allowed/authorized (if this is the right word)?

The other two unknown ip do come from the same subnet, but I have no idea why these connections are opened. Proto Recv-Q Send-Q Local Address Foreign Address State The 'Remote Host Name' is now also displayed for IPv6 addresses.When doing some network security checks (on which I am an amateur) for my office PC, I discovered a few unknown tcp6 connections (with netstat -nt): Active Internet connections (w/o servers) Just keep in mind that if you have Windows Vista or later, and UAC is turned on, then you'll need to run the program as an administrator to get all the relevant process information. It's compact, portable, and runs on anything from Windows 2000 to 8. In most situations, though, the program works very well. And so if a TCP connection is opened and closed in between those two points, TCPLogView will never notice its existence.

The program works by taking a snapshot of your open connections, and comparing it with the previous snapshot. (Getting the country name requires a couple of additional files available from the TCPLogView site.)

And this makes it ideal if you want to look back on all your internet and network connections, not just those currently open.Īs usual with NirSoft tools, all the relevant information is displayed in a neat grid: Event Time, Event Type (Open, Close, Listen), Local Address, Remote Address, Remote Host Name, Local Port, Remote Port, Process ID, Process Name, and the country information of the Remote IP.

TCPLogView is a portable tool which logs TCP connections on your PC as they're opened and closed.

Tcp log view