Nearly 2000 Outbound TCP port 1900 Connections! - WTF?

For the last week or so, Comodo Firewall (on the Summary tab) usually shows an enormous number of outbound connections – over 1900 of them (!) – after I launch Firefox, and all of them are TCP OUT connections from 192.168.1.100:xxxx to destination 192.168.1.1:1900. The source port numbers range from the 8550’s and then upwards.

What the heck is going on? That can’t be normal, can it?

I’m running 32-bit XP Pro/SP3, and Firefox 3.6.28 (some necessary add-ons are still not yet available for v12), and Comodo v 5.10.228257.2253 (free). Firefox has between 40 and 60 tabs open.

I’ve read that port 1900 is used by Universal Plug N’ Play, but not only is that service not running, Comodo reports the connection as TCP, whereas UPnP uses UDP connections on port 1900 (not TCP). So TCP 1900 has to be for something else, but I don’t know what that is or how to learn what process is actually using it.

I’ve attached an image file showing a subset of these weird connections.

Can anyone help me out with this?

[attachment deleted by admin]

The connections are made by svchost.exe. The point with svchost.exe is that it not clear what process is telling svchost.exe to be active.

To see that you need to look at the Process ID (PID) first. It is the number between the [ ]. Then download a tool like svchostviewer or svchost analyser to see what is behind svchost.exe by cross referencing the PID.

Thanks bunches, EricJH, for your very swift and helpful reply! It may take a day or two to work through this, but I wanted to thank you for your time and assistance right away…

Good day to you!

Hi Huzer,

I don’t use Firefox, but with Opera a similar behavior on port 1900 appears if opera Unite is not completely disable.

Opera Unite:

Opera Unite is a new technology platform allowing you to share content directly with friends, without having to upload anything to a Web site. You can stream music, show photo galleries, share files and folders, or even host your own Web pages directly from your browser.

Maybe you should check if you haven’t something similar enabled in Firefox and disable it if it’s useless for you.