networking basics
Posts tagged “networking basics”.
Encrypted DNS (DoH): what it hides, and from whom
DNS over HTTPS encrypts the names your PC looks up, so the Wi-Fi owner and your ISP can't read them. The resolver you use still sees every name, and the addresses you then connect to stay visible.
How to find which app is using a port on Windows
Run netstat -ano to get the process ID (PID) that owns the port, then look that PID up in Task Manager. PowerShell's Get-NetTCPConnection and Resource Monitor give the same answer.
How accurate is IP geolocation?
IP geolocation is usually right about the country and often wrong about the city. It's an educated guess from registry records and network measurements, and CDNs, anycast and VPNs throw it off.
How NetSecWall sees every connection without a driver
NetSecWall reads what Windows already records: kernel network events through ETW, DNS answers, and the TCP and UDP tables. It sees which app talks to which address without capturing a single packet.
Inbound and outbound connections, in plain English
A connection is outbound when your PC starts it, inbound when another machine does. Your router and Windows Firewall stop most unsolicited inbound traffic, so outbound is where apps phone home.
What is a port? 443, 53, 3389 and friends
A port is a number from 0 to 65535 that tells a computer which program a piece of network traffic is for. Servers wait on well-known ports like 443 or 53; your side uses a random high port.
How to see which apps are using your internet on Windows 11
Task Manager's Network column shows which apps are busy right now; Resource Monitor and netstat show where each one connects. For history, countries and alerts you need a per-app monitor.
ESTABLISHED, TIME_WAIT, LISTENING: TCP states decoded
TCP states show where a connection is in its life: LISTENING waits, SYN_SENT is dialing, ESTABLISHED is talking, CLOSE_WAIT and TIME_WAIT are the goodbye. Most are harmless; piles of some are clues.
Threat-intelligence IP lists: what they catch and what they miss
Threat-intelligence IP lists name addresses already tied to botnets, hacked machines, spam networks or Tor. They catch known infrastructure well but miss new servers and can mislabel shared addresses.
What your DNS lookups reveal about the apps on your PC
Before most connections, an app asks DNS for a name. A per-app list of those names shows which services each program uses, what it checks in with, and odd lookups worth a second look.
Why every app connects to Cloudflare, Akamai and Amazon
Most software companies don't serve their apps from their own servers. They rent content delivery networks and cloud platforms, so the address owner you see is usually the host, not the company.
What is the Windows Filtering Platform?
The Windows Filtering Platform (WFP) is the engine inside Windows that decides whether network traffic may pass. Windows Defender Firewall is built on it, and so are many VPNs and security tools.