Why would my system want to connect to this IP

[Ash_s]

Hi people, this is my first post and it's a problem that needs your help. I use NetLimiter to control my internet traffic. today NL gave a message that my system wants to connect to this Ip address 63.246.129.160 through the port 2574 and using udp protocol, so I was suspicious about this and wanted to know why would my system want to connect to a computer in Miami, Florida? here is the picure of NL message

also i would like to know if such things happen with you guys.

[CptMurphy]

Here's what I get from the whois database:

United Colocation Group, Inc. ASN-UNCGI-EXC-02 (NET-63-246-128-0-1) 
								  63.246.128.0 - 63.246.159.255
Guido Mora SAGO-63-246-129-160 (NET-63-246-129-160-1) 
								  63.246.129.160 - 63.246.129.169

Every once in a while my firewall says that my pc wants to connect to an ip but it's usually microsoft or from some program that I know about.

Here's some info about port 2574 UDP from the auditmypc.com site:

Port Number: 2574

TCP / UDP: UDP

Delivery: No

Protocol / Name: blockade-bpsp

Port Description: Blockade BPSP

Virus / Trojan: No

Side note: UDP port 2574 uses the Datagram Protocol, a communications protocol for the Internet network layer, transport layer, and session layer. This protocol when used over PORT 2574 makes possible the transmission of a datagram message from one computer to an application running in another computer. Like TCP (Transmission Control Protocol), UDP is used with IP (the Internet Protocol) but unlike TCP on Port 2574, UDP Port 2574 is connectionless and does not guarantee reliable communication; it's up to the application that received the message on Port 2574 to process any errors and verify correct delivery.

Edited February 14, 2006 by m3n70r

[Ash_s]

Thanks m3n70r, that helped a little bit.

[rendrag]

do you have any programs running that would want to connect to that IP? Does that program tell you where that connection request originated?

[LLXX]

Run netstat to get a list of connections and their associated processes.

Trojans and keyloggers are known for this type of behavior.

Edited February 15, 2006 by LLXX

[RogueSpear]

I'm not familiar with NetLimiter, so I'm wondering if it's possible for that program to tell you what process is trying to make this connection - even if it's just in a log file somewhere. If it does, you could narrow things down quite a bit.

[ravashaak]

TCPView might also be of some assistance. I think you can get it at sysinternals.com.

- Ravashaak

[Ash_s]

I appreciate all your replies you guys, but now I have this fantastic software that detects every bit of information enters my PC or leaves it, The name of the program is SoftPerfect Network Protocol Analyzer. and there is another one designed just for HTTP protocol and has the name HTTP Analyzer.

[rendrag]

so what's the story? was it a legit request to that IP or something more nefarious? inquiring minds want to know

[Porn Loader]

netstat -a -o will show processes associated with that port.