127.0.0.1 calls

[Bios1]

During Internet connections my Win2K system periodically makes internal calls (127.0.0.1) from one port to another. What does it mean ? interthread communication ?

[Bios1]

And what is the difference in behaviour between ports open by calls at IP address 127.0.01 and those at 0.0.0.0 ?

[dimm_coder]

127.0.0.1 is a so-called loopback interface. Only client processes running on the same machine as the server (the process which has opened such a connection) may establish a connection.
Thus these services are protected from the remote access. e.g. windoze services DCOM connections via the tcp port == 135, if U optionally says the DCOM service to bind this port only for the localhost interface (netstat shows localhost:135), noone outside can attack U using DCOM vulnerabilities which have been used by some viruses.
Your computer may have some network cards (not just the only one). Each of them has an IP address and if some server application binds on the specified IP address, it means that it may accept connections from client running on the some computer in the network specified by this IP.
If netstat shows *:port, * - means the server may accept connections from all interfaces.
0.0.0.0 is a special case. Your system may be configured not properly. Usually the IP stack is initialized with this address if a valid one is not available or during getting a real one via DHCP protocol.

[Bios1]

It's not an application which makes 127.0.01 calls, but the system (OS) itself which makes those periodical calls, duration about 1 min., interval about 5-10 min., I dont know which DLL. If it is abnormal, then I will continue my investigation. Anybody here watched his open ports ?