Sign in
 
HomeWindows 8Windows 7Windows VistaWindows XPMDOPWindows IntuneLibraryForums
Windows Client >
> 
> 
TCP Local ICSLAP Remote 1780

Answered TCP Local ICSLAP Remote 1780

  • Friday, October 14, 2011 3:54 AM
     
     
    Sign In to Vote
    0

    TCPView shows these.

    Process    PID    Protocol    Local Address    Local Port    Remote Address    Remote Port    State
    [System Process]    0    TCP    myPC    icslap    192.168.0.1    19286    TIME_WAIT
    [System Process]    0    TCP    myPC    50571    192.168.0.1    1780    TIME_WAIT
    [System Process]    0    TCP    myPC    50572    192.168.0.1    1780    TIME_WAIT
    [System Process]    0    TCP    myPC    50573    192.168.0.1    1780    TIME_WAIT
    [System Process]    0    TCP    myPC    icslap    192.168.0.1    5177    TIME_WAIT
    [System Process]    0    TCP    myPC    50574    192.168.0.1    1780    TIME_WAIT
    [System Process]    0    TCP    myPC    50575    192.168.0.1    1780    TIME_WAIT
    ...

    They just keep popping up non-stop.
    A Local Port ICSLAP entry is followed by several serial like 50571 50572 etc.
    Remote Port like 19286 5177 etc is dynamic, whereas 1780 remains static.
    Remote Address 192.168.0.1 is my router.

    Since it's always [System Process] PID 0, I don't know how to find out if anything bad is behind.
    Various security scans yield nothing.
    Any advice will be appreciated. Thanks in advance!

     

All Replies

  • Friday, October 14, 2011 7:25 AM
     
     Proposed Answer
    Sign In to Vote
    0

    i browsed the topic on internet.. I got this info:

    http://www.grc.com/port_2869.htm

    Regards, h9ck3r.
     
  • Tuesday, February 28, 2012 12:55 AM
     
     Answered
    Sign In to Vote
    0

    Finally, after months of figuring, those ICSLAP and their child entries would stop popping if these services are disabled:

    SSDPSRV (SSDP Discovery)
    Mcx2Svc (Media Center Extender Service)
    upnphost (UPnP Device Host)

    So, apparently, there was no evil behind, though the neverending entries were annoying.

    Still no idea why the child entries always showed Remote Port 1780, but that no longer matters.

    BTW, neither MpsSvc (Windows Firewall, in XP known as Internet Connection Firewall ICF) nor SharedAccess (Internet Connection Sharing ICS) caused the subject entries, though both services would rely on Local Port 2869 ICSLAP.

    • Marked As Answer by Cedric Chinnok Tuesday, February 28, 2012 12:56 AM
    •