3

So, I was messing around with netstat to learn more about addressing when I decided to run it on my local machine and see what processes were holding open ports.

I came across this...

tcp        0      0 XXX:42254        172.217.0.13:443        ESTABLISHED 7275/libpepflashpla
tcp        0      0 XXX:53804        72.5.205.39:443         ESTABLISHED 7275/libpepflashpla
tcp        0      0 XXX:49172        172.217.8.174:443       ESTABLISHED 7275/libpepflashpla
tcp        0      0 XXX:53800        72.5.205.39:443         ESTABLISHED 7275/libpepflashpla
tcp        0      0 XXX:40632        173.194.67.138:443      TIME_WAIT   -               
tcp        0      0 XXX:59292        172.217.0.3:80          ESTABLISHED 7275/libpepflashpla
tcp        0      0 XXX:54446        216.58.216.194:443      TIME_WAIT   -               
tcp      242      0 XXX:48564        23.211.100.195:443      ESTABLISHED 7275/libpepflashpla
tcp        0      0 XXX:59490        40.97.117.242:443       ESTABLISHED 7275/libpepflashpla
tcp        0      0 XXX:53652        198.252.206.25:443      ESTABLISHED 7275/libpepflashpla
tcp        0      0 XXX:59494        40.97.117.242:443       ESTABLISHED 7275/libpepflashpla
tcp        0      0 XXX:37850        216.58.192.170:80       ESTABLISHED 7275/libpepflashpla
tcp      258      0 XXX:34482        151.101.193.69:443      ESTABLISHED 7275/libpepflashpla
tcp        0      0 XXX:36038        104.16.108.18:443       TIME_WAIT   -               
tcp      242      0 XXX:59090        23.194.169.123:443      ESTABLISHED 7275/libpepflashpla
tcp        0      0 XXX:58026        23.21.110.0:443         ESTABLISHED 7275/libpepflashpla
tcp        0      0 XXX:45658        192.0.73.2:443          ESTABLISHED 7275/libpepflashpla
tcp        0      0 XXX:54048        104.28.31.80:80         ESTABLISHED 7275/libpepflashpla
tcp        0      0 XXX:43670        216.58.192.138:443      ESTABLISHED 7275/libpepflashpla
tcp        0      0 XXX:42252        172.217.0.13:443        ESTABLISHED 7275/libpepflashpla
tcp        0      0 XXX:45664        192.0.73.2:443          ESTABLISHED 7275/libpepflashpla
tcp        0      0 XXX:48572        23.211.100.195:443      ESTABLISHED 7275/libpepflashpla
tcp        0      0 XXX:38600        151.101.193.69:80       TIME_WAIT   -               
tcp        0      0 XXX:59496        40.97.117.242:443       ESTABLISHED 7275/libpepflashpla
tcp        0      0 XXX:33772        172.217.9.35:443        ESTABLISHED 7275/libpepflashpla
tcp        0      0 XXX:60214        172.217.6.10:80         TIME_WAIT   -               
tcp        0      0 XXX:53624        198.252.206.25:443      ESTABLISHED 7275/libpepflashpla
tcp        0      0 XXX:50110        72.5.205.53:443         ESTABLISHED 7275/libpepflashpla
tcp        0      0 XXX:52816        70.37.96.155:443        ESTABLISHED 7275/libpepflashpla
tcp      242      0 XXX:59094        23.194.169.123:443      ESTABLISHED 7275/libpepflashpla
tcp        0      0 XXX:54052        104.28.31.80:80         ESTABLISHED 7275/libpepflashpla
tcp        0      0 XXX:59460        40.97.117.242:443       ESTABLISHED 7275/libpepflashpla
tcp        0      0 XXX:46308        172.217.6.14:443        ESTABLISHED 7275/libpepflashpla
tcp        0      0 XXX:54050        104.28.31.80:80         ESTABLISHED 7275/libpepflashpla
tcp        0      0 XXX:53816        72.5.205.39:443         ESTABLISHED 7275/libpepflashpla
tcp        0      0 XXX:55088        138.91.243.193:443      ESTABLISHED 7275/libpepflashpla
tcp        0      0 XXX:59712        172.217.9.46:443        TIME_WAIT   -               
tcp        0      0 XXX:45536        192.0.73.2:443          TIME_WAIT   -               
tcp        0      0 XXX:58024        23.21.110.0:443         ESTABLISHED 7275/libpepflashpla
tcp        0      0 XXX:37852        216.58.192.170:80       ESTABLISHED 7275/libpepflashpla
tcp      242      0 XXX:48562        23.211.100.195:443      ESTABLISHED 7275/libpepflashpla
tcp        0      0 XXX:34310        151.101.129.69:443      ESTABLISHED 7275/libpepflashpla
tcp        0      0 XXX:58028        23.21.110.0:443         ESTABLISHED 7275/libpepflashpla
tcp        0      0 XXX:54044        104.28.31.80:80         ESTABLISHED 7275/libpepflashpla
tcp      242      0 XXX:59088        23.194.169.123:443      ESTABLISHED 7275/libpepflashpla
tcp      242      0 XXX:59096        23.194.169.123:443      ESTABLISHED 7275/libpepflashpla
tcp        0      0 XXX:45310        178.79.134.250:22       ESTABLISHED 6978/ssh        
tcp        0      0 XXX:34274        151.101.129.69:443      ESTABLISHED 7275/libpepflashpla
tcp        0      0 XXX:59492        40.97.117.242:443       ESTABLISHED 7275/libpepflashpla
tcp        0      0 XXX:52672        70.37.96.155:443        TIME_WAIT   -               
tcp        0      0 XXX:50130        72.5.205.53:443         ESTABLISHED 7275/libpepflashpla
tcp        0      0 XXX:59118        172.217.0.3:80          TIME_WAIT   -               
tcp        0      0 XXX:50760        184.24.107.198:443      ESTABLISHED 7275/libpepflashpla
tcp        0      0 XXX:48942        172.217.8.174:443       TIME_WAIT   -               
tcp        0      0 XXX:58056        23.21.110.0:443         ESTABLISHED 7275/libpepflashpla
tcp        0      0 XXX:53802        72.5.205.39:443         ESTABLISHED 7275/libpepflashpla
tcp        0      0 XXX:51268        104.208.31.113:443      ESTABLISHED 7275/libpepflashpla
tcp      392      0 XXX:33774        172.217.9.35:443        ESTABLISHED 7275/libpepflashpla
tcp        0      0 XXX:50780        184.24.107.198:443      ESTABLISHED 7275/libpepflashpla
tcp        0      0 XXX:49166        172.217.8.174:443       ESTABLISHED 7275/libpepflashpla
tcp      242      0 XXX:59086        23.194.169.123:443      ESTABLISHED 7275/libpepflashpla
tcp      258      0 XXX:34010        104.16.109.18:443       ESTABLISHED 7275/libpepflashpla
tcp        0      0 XXX:58628        172.217.6.110:443       TIME_WAIT   -               
tcp        0      0 XXX:59498        40.97.117.242:443       ESTABLISHED 7275/libpepflashpla
tcp        0      0 XXX:54046        104.28.31.80:80         ESTABLISHED 7275/libpepflashpla
tcp      242      0 XXX:48566        23.211.100.195:443      ESTABLISHED 7275/libpepflashpla
tcp        0      0 XXX:35538        216.58.194.68:443       TIME_WAIT   -               
tcp      242      0 XXX:59092        23.194.169.123:443      ESTABLISHED 7275/libpepflashpla
tcp        0      0 XXX:36036        104.16.108.18:443       TIME_WAIT   -               
tcp        0      0 XXX:54054        104.28.31.80:80         ESTABLISHED 7275/libpepflashpla

**Note, XXX indicates my local IP

Why is pepperflashplayer holding so many http and https connections open?! I only have 4 tabs right in chrome right now, and its a flashplayer... Shouldn't that mean it only needs one connection for each connected site that is using flash? None of my tabs need a flash player running to my knowledge.

I've also noticed that the process is connecting to the same foreign IP and port multiple times, from different ports on my local machine. Is my pepperflashplayer bugged? Could this indicate malicious activity?

There is no reason to hold this many connections open on obscure ports.

My official questions are this: how can I fix this? Why is pepperflashplayer doing this? How can I stop it from happening again?

  • It very depends on what is running inside of this plugin. It can be game, advertisements or trackers in each of the tabs or all of them. And specially trackers really like to send various messages "home". Every port you can see is one HTTP(S) request that was not closed (yet). And why so obscure ports on your IP -- because they are assigned to the HTTP(S) request initiator by "random". Good start is to read how the TCP/IP connection itself works. – Jakuje May 1 '17 at 21:04
  • Ok, so that makes since why the port numbers are so strange. I have an adblocker running so it shouldn't be adds right? Unless Adblockplus isn't closing the connections. Is there a way I can turn off any trackers? And how can I check what is running inside of this plugin? – ExecutionByFork May 1 '17 at 21:14
  • If you resolve those IP addresses, the first three are Google (1e100.net), Quantserve, and Google... So probably it's ads. BTW: Jakuje, if you make your comment an answer (and you should) feel free to incorporate my comment. – derobert May 1 '17 at 21:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.