What is tn-tl-fd1 on port 476

[stickyb]

Does anyone know what tn-tl-fd1 is running in svchost and listening on port 476 (Windows 2000)?

Can't find antything useful on MS site or Google

[BOAC]

Idly Googling and found this (http://wwwesto.ump.ma/mounir/index.php?option=com_content&task=view&id=121&Itemid=25) listing (Google will translate) and it appears to be known.

[stickyb]

Indeed it appears to be known, but what is it? The list you pointed to doesn't appear to distinguish between good or bad entries

[BOAC]

Honestly, I have no idea! Just trying to help by idle Googling and also found this (http://www.auditmypc.com/port/udp-port-476.asp).

[bnt]

When you say "running in svchost", is that what it says when you run netstat -b?
"Svchost" is the "Server" service, so that doesn't tell you much, but you can narrow it down a bit further:
- run netstat -b again, and make a note of the number in the PID column (the Process ID), next to port 476.
- run the following command with admin rights, inserting the PID where indicated:
tasklist /svc /fi "PID eq the_PID"
That lists the programs or services using that PID. "tn-tl-fd1" is just the "well-known name" of port 476, it doesn't tell us which program opened it up.

[Saab Dastard]

I dunno what it is, but it is one of the IANA managed (well-known ports):

tn-tl-fd1 476/tcp tn-tl-fd1
tn-tl-fd1 476/udp tn-tl-fd1
# Ed Kress <eskress&thinknet.com>

WELL KNOWN PORT NUMBERS

The Well Known Ports are assigned by the IANA and on most systems can
only be used by system (or root) processes or by programs executed by
privileged users.

Ports are used in the TCP [RFC793] to name the ends of logical
connections which carry long term conversations. For the purpose of
providing services to unknown callers, a service contact port is
defined. This list specifies the port used by the server process as
its contact port. The contact port is sometimes called the
"well-known port".


ASSIGNMENT OF A PORT NUMBER DOES NOT IN ANY WAY IMPLY AN *
* ENDORSEMENT OF AN APPLICATION OR PRODUCT, AND THE FACT THAT NETWORK *
* TRAFFIC IS FLOWING TO OR FROM A REGISTERED PORT DOES NOT MEAN THAT *
* IT IS "GOOD" TRAFFIC. FIREWALL AND SYSTEM ADMINISTRATORS SHOULD *
* CHOOSE HOW TO CONFIGURE THEIR SYSTEMS BASED ON THEIR KNOWLEDGE OF *
* THE TRAFFIC IN QUESTION, NOT WHETHER THERE IS A PORT NUMBER *
* REGISTERED OR NOT.

SD