Protecting the machine

Reading a connection

Ports, protocols, socket states, CDNs, and country tags — how to tell ordinary traffic from something worth acting on.

8 min read · updated July 25, 2026

Expanding a process gives you a row per connection, and each row carries five or six facts. Knowing what they mean is the difference between “this looks scary” and “this is a browser fetching a font.” This page is the decoder.

One connection row, field by field

└142.250.187.206:443ESTABLISHEDTCP4.80 MB · US · www.google.com

address : port · socket state · protocol · total · country · resolved host

Ports: what the number means

Port	Usually	Worth a look when
`443`	HTTPS — the overwhelming majority of everything	Almost never on its own
`80`	Plain HTTP	A program sending data unencrypted in 2026
`53`, `853`	DNS and DNS-over-TLS	Anything other than your resolver or browser doing it
`123`	Time sync	Essentially never
`22`, `3389`	SSH, Remote Desktop	Inbound from somewhere you don't recognize
High, random	Peer-to-peer, games, WebRTC calls	A program with no reason to do peer-to-peer

A port tells you the kind of service, not whether it's safe. Malware overwhelmingly uses 443, precisely because it blends in. Port is context, never a verdict.

Socket states

ESTABLISHED — open and usable. What you see most.
TIME_WAIT — recently closed; the OS is holding the slot briefly. Perfectly normal, often in large numbers.
SYN_SENT — trying to connect and not getting an answer. A row stuck here means the far end is unreachable, filtered, or blocked by a rule you made.
CLOSE_WAIT — the far end hung up and the program hasn't cleaned up. Piles of these point at a buggy application, not at an attack.

Lots of SYN_SENT from one app right after you changed something is the clearest signal you have that you blocked more than you meant to.

Country tags and why they mislead

The country comes from geolocating the address. It's accurate for where the serveris, which is often not where the company is and frequently not where your data ends up. A CDN sends you to whichever edge is closest, so the same service can appear as three countries in a week.

Do not read “connection to a country I dislike” as “my data went to that country.” It means a machine with an address registered there answered. Judge the program and the hostname first; country is the weakest signal on the row.

Network / CDN owner

Grouped views show the network owner from ASN data — Cloudflare, Amazon, Akamai, Fastly, and so on. This is genuinely useful: it turns an anonymous address into “this is a CDN,” which explains most of the addresses you won't recognize. An address owned by a residential ISP rather than a hosting provider is far more interesting, because ordinary software doesn't talk to people's houses.

Putting it together

Same facts, two very different readings:

Ordinary	Worth investigating
Browser · 443 · ESTABLISHED · Cloudflare · resolved hostname · megabytes	Unknown exe from a temp folder · 443 · residential ISP · no hostname · a few hundred bytes every 60 seconds
Many short connections while a page loads	One connection held open for days, moving almost nothing
Big download from a name you recognize	Steady upload from a program that has no reason to send anything

The pattern that matters most is the last one in each column: small, regular, unexplained. Volume attracts attention, but beaconing is the shape that actually indicates something is reporting in. See Threat intelligence & detection.

No resolved hostname is a mild signal in itself. Most legitimate services have reverse DNS or were reached by name in the first place; a raw address with nothing behind it deserves the extra 30 seconds.

Still stuck? Open a support ticket — we reply within one business day.