I took a snapshot of my connections while only Xolox was running using 'Netstat -na' and saw a couple ports open I don't know of. (See below)

Microsoft Windows XP [Version 5.1.2600]

Active Connections

Proto Local Address Foreign Address State
TCP 0.0.0.0:135 0.0.0.0:0 LISTENING
TCP 0.0.0.0:445 0.0.0.0:0 LISTENING
TCP 0.0.0.0:1025 0.0.0.0:0 LISTENING
TCP 0.0.0.0:1027 0.0.0.0:0 LISTENING
TCP 0.0.0.0:3816 0.0.0.0:0 LISTENING
TCP 0.0.0.0:3823 0.0.0.0:0 LISTENING
TCP 0.0.0.0:4058 0.0.0.0:0 LISTENING
TCP 0.0.0.0:4104 0.0.0.0:0 LISTENING
TCP 0.0.0.0:4336 0.0.0.0:0 LISTENING
TCP 0.0.0.0:4651 0.0.0.0:0 LISTENING
TCP 0.0.0.0:4883 0.0.0.0:0 LISTENING
TCP 0.0.0.0:4954 0.0.0.0:0 LISTENING
TCP 0.0.0.0:4958 0.0.0.0:0 LISTENING
TCP 0.0.0.0:4962 0.0.0.0:0 LISTENING
TCP 0.0.0.0:4966 0.0.0.0:0 LISTENING
TCP 0.0.0.0:4970 0.0.0.0:0 LISTENING
TCP 0.0.0.0:4977 0.0.0.0:0 LISTENING
TCP 0.0.0.0:4979 0.0.0.0:0 LISTENING
TCP 0.0.0.0:4988 0.0.0.0:0 LISTENING
TCP 0.0.0.0:5000 0.0.0.0:0 LISTENING
TCP 0.0.0.0:6346 0.0.0.0:0 LISTENING
TCP ---my ip---:3816 142.59.219.98:6347 ESTABLISHED
TCP ---my ip---:3823 209.86.171.13:6346 ESTABLISHED
TCP ---my ip---:4058 208.129.36.166:10101 ESTABLISHED
TCP ---my ip---:4104 193.10.201.111:6346 ESTABLISHED
TCP ---my ip---:4336 139.165.103.26:6346 ESTABLISHED
TCP ---my ip---:4651 66.26.45.221:6346 ESTABLISHED
TCP ---my ip---:4883 24.49.78.24:6347 ESTABLISHED
TCP ---my ip---:4954 217.225.78.118:6346 LAST_ACK
TCP ---my ip---:4958 217.81.37.117:6346 LAST_ACK
TCP ---my ip---:4962 131.234.96.13:6346 ESTABLISHED
TCP ---my ip---:4966 217.225.78.118:6346 LAST_ACK
TCP ---my ip---:4970 217.81.37.117:6346 LAST_ACK
TCP ---my ip---:4977 217.225.78.118:6346 LAST_ACK
TCP ---my ip---:4979 131.111.193.139:6346 LAST_ACK
TCP ---my ip---:4988 217.225.78.118:6346 LAST_ACK
TCP 127.0.0.1:3001 0.0.0.0:0 LISTENING
TCP 127.0.0.1:3002 0.0.0.0:0 LISTENING
TCP 127.0.0.1:3003 0.0.0.0:0 LISTENING
UDP 0.0.0.0:445 *:*
UDP 0.0.0.0:1026 *:*
UDP 0.0.0.0:3004 *:*
UDP 0.0.0.0:3284 *:*
UDP ---my ip---:123 *:*
UDP ---my ip---:1900 *:*
UDP ---my ip---:2234 *:*
UDP 127.0.0.1:123 *:*
UDP 127.0.0.1:1900 *:*
UDP 127.0.0.1:2234 *:*
UDP 127.0.0.1:3618 *:*


What are these ports for: TCP-10101, UDP-123 / 1900 / 2234 ???

Should Xolox be using these ports???


Just wondering.

Sorry, I have no XP here. Can you make a diff about which ports are used when Xolox does not run, so we can see which ports Xolox uses, which XP itself? Also you might want to read some basics about the gnutella network, here.

Basically gnutella clients (or better called gnutella 'servants', Xolox is one of them) listens on port 6346 TCP. It is possible to make the most gnutella clients listen on a different port, but the default port and most times used is 6346 (Xolox does). Gnutella will not use UDP at all.

Then you will see typically between 1-6 TCP connections from your computer (random highport) to another IP on port 6346. This is your connection to the gnutella network, and these connection will keep established as long as you stay connected to the gnutella network (you are part of the gnutella network)! Sometimes a host drops and your client will automatically try to connect to another, to keep up connection to gnutella network.
It might happen that you see a lot of old disconnected TCP connection in your netstat output (make sure you understand what the different TCP states mean). This because at startup your client will try to connect many many hosts (from the hostslist.txt or queried hosts caches)... to build a fast connection to the gnutella network.

Additionally you have one TCP connection for every file or partial you download. You remember, gnutella file transfar is P2P (direct peer to peer). Those connections are eigther from your IP (random highport) to another IP on port 6346 - or if requested an 'Push' (other host is behind firewall) you see a connection from another IP (random highport) to your IP on port 6346. Similar for file you upload.

Hope this gives a short overview. It might be tricky to interpret the netstat output, because gnutella is _not_ bound to port 6346 only, okay 99% of all clients do. It might happen that some clients run on another port (a feature to stand against e.g. RIAA attacks).
Make sure you understand network basics, TCP handshaking and gnutella protocoll.

Any further geek questions? Moak

Thanks for the reply. I did a 'netstat -na' without xolox running, or any other appz besides WinXP's standard background stuff and I had zero outbound connections. So I'm fairly sure that all the outbound connections shown in the list I gave are all being used by xolox. (Not the UDP ones though.)

Also, I would like to be able to change the default port from 6346 to something else. Is this possible? By using Resource Hacker for example???

yes it's possible, I did post something. Search for '6347'... or ask if you can't find the thread. Good night, Moak