Xolox won't close entirely

[thypentacle]

I noticed that when I exit xolox all the way, even closing the task icon, that it still keeps a connection open. I can see this using Tiny Personal Firewall's 'Firewall Status Window' to look at current connections. By pressing ctrl+alt+del I see that xolox does not show up and seems to be closed, so why are there still connections open to it???

[Moak]

Hi! Can you give please more informations (IP/port/protocoll/source/destination/etc) what kind of connection is kept open? What makes you think it's Xolox? I have some downloads running, but can check it later.

[thypentacle]

I'm not sure what the IP addresses or ports were and I can't seem to get it to do it every time. It seems to only do it if I leave it on overnight and close it while someone is downloading off me. Whoever happens to be downloading continues to do so even if I close xolox. I don't know for sure if it's xolox causing the problem I'll keep an eye on it and get that info next time.

Also, is the xolox web site down? I can't seem to get it to load for some reason. The reason I ask is that I wanted to help out a little so I improved the XoloX desktop icon to look a bit less blocky and I wanted to email the new icon to the Xolox team. What is the email address I could use???

[The Seeker]

Are you sending any data out or just getting hits on ports?

When you connect to the network, then disconnect later, two things may happen that cause people to send data to your machine on port 6436.

1) You have been entered into hostcaches, and people are trying to use you as a connection point.

2) You have a file someone wanted, and their client keeps trying to connect even if you're gone. (This would probably happen a lot if you close down while someone is downloading)

[Moak]

Hi thypentacle,
I think Seeker posting is a good explanation (as usual) of typical Gnutella incoming conections, after closing your client. You will see this behaviour with any other client too... and actually not very suprising. Just to make sure we need more information (see above, is it incoming or outgoing, which state TCP_WAIT?).

The above explained connection attemps (from Seeker) are the only things I see here on my box, there are no permanent established outgoing connections or remaining threads after closing Xolox (make sure you even close it in the taskbar). I restarted Xolox twice and waited to have uploads before closing it.
Btw in my packetfilter logs I see over 6000 rejected incoming connections to port 6346 and 80 the last months. Those are gnutella clients who are eighther misconfigured or try hammering without any client respond.... nothing to get nervous.

Xolox web side seems to be down (can't even ping anymore).

[thypentacle]

Thanks for such good explanations. (I think I was worried over nothing.) The Seeker seems to have hit the nail right on the head as his explanation seems to be what's going on. Also, I think the connections were incoming. I do remember noticing that no data was being sent or recieved. It just showed a connection that wasn't doing anything. I'm not an expert on this stuff so I don't know how else to explain it, but I'm not going to worry about it. It also could be that Tiny Personal Firewall simply showed a connection that WAS there but isn't anymore. Could be a bug in the firewall status window. Does anyone else out there use TPF and have you noticed it showing ghost connections???

Also, what's going on with the xolox web site? Did it move or something?

[Moak]

PS: I found out those multiple connects on port 80 are from worms not gnutella clients. After enabling port 80 connects from outside, I found in the httpd log MANY requests to start a file root.exe... so it's from code-red/nimda infected hosts, tells Google.

Just by closing the program alone does not fully close Xolox, it is still running in the back ground. To fully close Xolox, double right click the Xolox icon in the lower right hand corner of your system tray. Choose exit, then left click. This wil totally close Xolox.