TCPView shows these. Process PID Protocol Local Address Local Port Remote Address Remote Port State [System Process] 0 TCP myPC icslap 192.168.0.1 19286 TIME_WAIT [System Process] 0 TCP myPC 50571 192.168.0.1 1780 TIME_WAIT [System Process] 0 TCP myPC 50572 192.168.0.1 1780 TIME_WAIT [System Process] 0 TCP myPC 50573 192.168.0.1 1780 TIME_WAIT [System Process] 0 TCP myPC icslap 192.168.0.1 5177 TIME_WAIT [System Process] 0 TCP myPC 50574 192.168.0.1 1780 TIME_WAIT [System Process] 0 TCP myPC 50575 192.168.0.1 1780 TIME_WAIT ... They just keep popping up non-stop. A Local Port ICSLAP entry is followed by several serial like 50571 50572 etc. Remote Port like 19286 5177 etc is dynamic, whereas 1780 remains static. Remote Address 192.168.0.1 is my router. Since it's always [System Process] PID 0, I don't know how to find out if anything bad is behind. Various security scans yield nothing. Any advice will be appreciated. Thanks in advance!

i browsed the topic on internet.. I got this info: http://www.grc.com/port_2869.htm Regards, h9ck3r.

Finally, after months of figuring, those ICSLAP and their child entries would stop popping if these services are disabled: SSDPSRV (SSDP Discovery) Mcx2Svc (Media Center Extender Service) upnphost (UPnP Device Host) So, apparently, there was no evil behind, though the neverending entries were annoying. Still no idea why the child entries always showed Remote Port 1780, but that no longer matters. BTW, neither MpsSvc (Windows Firewall, in XP known as Internet Connection Firewall ICF) nor SharedAccess (Internet Connection Sharing ICS) caused the subject entries, though both services would rely on Local Port 2869 ICSLAP.