# Elastic auditbeat v6 vs v7 unknown TCP connects

**URL:** <https://discuss.elastic.co/t/elastic-auditbeat-v6-vs-v7-unknown-tcp-connects/363516>\
**Category:** Beats\
**Tags:** auditbeat\
**Created:** [July 22, 2024, 4:04am UTC](https://discuss.elastic.co/t/elastic-auditbeat-v6-vs-v7-unknown-tcp-connects/363516 "2024-07-22T04:04:38Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![ficco2024](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ficco2024/32/128895_2.png) [@ficco2024](https://discuss.elastic.co/u/ficco2024)\
**Post date:** [July 22, 2024, 4:04am UTC](https://discuss.elastic.co/t/elastic-auditbeat-v6-vs-v7-unknown-tcp-connects/363516/1 "2024-07-22T04:04:38Z")

</div>

Hello,

I am seeing unknown TCP connections in auditbeat when processing or publishing events in v6.7 but there is no such unknown connections in v7+. Is it correct old version behavior and what is it used for?

Here is the screenshot in v6.7 the port 8889 is correct one

 ![Screenshot 2024-07-21 at 9.03.50 PM](https://us1.discourse-cdn.com/elastic/original/3X/f/8/f86df4f57e903b09d6e88dac19fcbc5d9ec6b8eb.png)

---

<div class="post-metadata">

**Author:** ![ficco2024](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ficco2024/32/128895_2.png) [@ficco2024](https://discuss.elastic.co/u/ficco2024)\
**Post date:** [July 22, 2024, 4:05am UTC](https://discuss.elastic.co/t/elastic-auditbeat-v6-vs-v7-unknown-tcp-connects/363516/2 "2024-07-22T04:05:10Z")

</div>

Similar issue in another windows machine:

 ![Screenshot 2024-07-18 at 1.01.12 AM](https://us1.discourse-cdn.com/elastic/original/3X/f/3/f3a10f0a2f38292365ec838dccb80e78a83f35f4.jpeg)