Curious - Why ashWebSv.exe has IP OUTbound connections?

General Topics
1

I recently installed the Comodo Firewall and, of course, it provides lots of interesting info. And I think I even understand SOME of it. One piece of info is a list of the inbound and outbound IP connections. I notice that ashWebSv.exe often has several (sometimes more than 10) outbound connections.
I’m curious about what it is doing with those connections?
–Larry

2

For each page that you load in your browser it requires a connection and there will be a corresponding web shield connection as it scan the web traffic coming into your system.

You should also notice that many of them are Localhost connections, these are what the web shield is scanning of pages that your browser requested before they are saved to your browser cache and displayed on said browser, see image.

There shouldn’t be that many TCP outbound connections, they will invariable be what your browser requests.

3

Just to add:

You see from DavidR picture that there is only one HTTP connection(port 80) at the moment and that’s
from Ashwebsv. Ashwebsv checks the http stream from server and delivers it to port 12080(local) after checking it.

Firefox is listening on port 12080(local) and gets the scanned HTTP steam from Ashwebsv(if it is ok).

I am using ZA, and if I give svchost.exe neccessary permissions, it will take care of DNS-lookups.

So if I only visit HTTP sites my Opera doesn’t need Internet access, only local access to use the ZA terms.

Of course this stops if I visit e.g. a HTTPS site where Ashwebsv is out of the picture and Opera needs Internet access to go there. (or to a FTP site ).

This is my view of how it works.

4

The TCP connections shown by Comodo look very different from those in DavidR picture.
I will try attaching an image showing my connections taken a few minutes ago.
–Larry

5

You have connections at the moment to 5 different sites at port 80 through ashwebsv,
as explained earlier. (HTTP connections).

The number of connections to each site varies as usual.

Firefox is listening at different local ports behind your firewall for input from ashwebsv.

192.168… are your local IP-addresses and local port-numbers behind your firewall. I think you are behind a router or something.

There is nothing special, but different firewalls look a bit different.

HL