LabVIEW
Labview Process TCP/IP and Google-Analystics:51142
PointOnePa wrote:
I recently was using ProcessExplorer from Sysinternatls.com to see what processes were running with a Labview application. The tool has a TCP/IP tab, which lists a link to www.google-analytics.com:51xyz anytime I open Labview V8.6, with a status of "Listening", where xyz changes everytime that I open a new Labview session.
I'm not familar with the details of ProcessExplorer, but the documentations states:
"TCP/IP: Any active TCP and UDP endpoints owned by the process are shown on this page."
I'm just curious if anyone knows why Labview would be communicating with google-analytics? I know that google-analytics is used to collect statistics. A quick search of...goggle didn't reveal anything specific to Labview.
I've circumvent this link by adding google-analytics.com to the host table.
Under Windows that would be:
c:\Windows\System32\etc\host
127.0.0.1 www.google-analytics.com
such that www.google-analytics.com:51xyz gets mapped to 127.0.0.1:51xyz.
But I'm curious to know why it is there in the first place.
Well the google-analytics stuff is probably something Process Explorer does for whatever reasons or something else your computer has been infected by. LabVIEW simply opens a TCP/IP port and registers it as a service with the local NI Service Locator. This is not to snoop your data but to allow for instance remote debugging and things like shared variables to work in your local network (and could theoretically be used for other less friendly things although I'm confident NI itself won't do that, and I would hope you are running a firewall towards the internet to make sure those ports are not exposed to the wild west of internet).
Basically TCP/IP knows 65536 port numbers. A well known service needs also a well known port number to be reached. But there are only so many port numbers available so there is no way every application in the world can get its own unique well known port number. The solution is as follows:
There are some very well known port numbers residing below 1024. New basic internet protocols can get a number out of that pool. Then there are numbers between 1024 and something like 46000 which are available to companies to register some services on. NI registered one of them for their Service Locator service. Not sure why they did that as there are other such services already but maybe there are legal reasons about using those others.
Now when a LabVIEW process starts it first opens an arbitrary port (the OS gives it any not currently used port above 1024) and then it tries to contact that service locater on the local machine and registers itself under a service name and with that port number. When a remote LabVIEW instance is directed to contact a specific machine to do a remote debugging session, this instance first contacts the NI Service Locator on the well known port on that machine and asks it about the actually used LabVIEW debug port number and then connects to that port to initiate the debug session. A similar functionality is in fact also used for remote targets such as RT controllers to allow a LabVIEW IDE to seemlessly integrate such a remote target into the LabVIEW project.
What you see is the opened port 51xyz for the LabVIEW server and that port has been registered with the local NI Service Locater. This port should be in fact a listen socket and just sits there to wait for incoming requests from other LabVIEW instances for remote debugging or such. It should not have any connection open to any other remote system unless you are explicitedly doing something from another LabVIEW application to interact with this LabVIEW instance.
About the URL you are seeing: Basically Process Explorer seems to take the port number allocated to your LabVIEW process and attaches it to www.google-analytics.com trying to contact a web server at that address and under that port. A number attached to an URL after a colon simply tells the browser to use that number as port number instead of the default port used for the current protocol (80 for http:, 21 for ftp:, etc)
Why it would do that is completely beyond me. It could be a bug in Process Explorer or your machine is compromised in some other ways but I can't say for sure.
Rolf Kalbermatter
