I have Windows 7 and have noticed that my system is using port 4 to connect to a lot of different IP addresses. When it connects to them it is not for very long before it moves to another IP address.
One night I sat and wrote down as many as I could and started checking whois to see where they were and they were from all over the world. I don't understand this.
When I did a search on the net with this question. The only info I could come up with was, that port 4 is used by the US Army and a list of port assignments listed it as "unassigned". If anyone has any clues to what is going on... I would greatly appreciate any info I could get.
1 Answer
Conjecture: Malware or botnet is contacting a Command/Control Server.
Other possibilities: Undocumented functionality in windows is engaged in some sort of behavior. You can probably stop outgoing connections to port4 with a firewall, but I suggest you use an external firewall to configure the block.
As in the comments above: You might learn a lot by reading the data using wireshark.
