With that being said, I would like to know how to analyze the TCPView? What does Listening and Established mean? What's normal and not so normal on Window XP Home Edition?
For those who do not know, TCPView by Sysinternals is a program that shows all listening and established sockets, or connections, on your computer in real time. It will also tell you what programs are using these particular connections, and who they may be connected to. Being able to see this is extremely important when doing Computer Forensics as you can see what ports are open and what programs are using them allowing you to easily pinpoint where a backdoor on the system may be present.
Now back to the question:
When a program is running on a computer that uses TCP and waits for another computer to connect to it, it is said to be "listening" for connections. The program attaches itself to a port on your computer and waits for a connection. When it does this it is what is known as being in a listening state. When a remote computer connects to that particular port and "establishes" a connection, that particular sessions is known as an established session because the two computers are now connected to each other.
To sum it up, a listening port is one that is waiting for a connection. An established port is one that is connected to a remote computer.
As for what common ports that would be open on XP Home:
Seeing those ports should not alarm you and it is not uncommon to see other ports listening as well. You should pay more attention to the program names that are listening on the Internet rather than the ports sometimes. If you see c:\windows\system32\svchost.exe listening on a few connections do not be alarmed. This is common as svchost.exe is a loader for many other programs.
Hope this clears up some of your questions.
Edit: Fixed broken link for TCPView.
Edited by quietman7, 30 November 2010 - 12:13 PM.