Excessive Port 80 TCP Connections? How many connections are normal?

Question

Hi. I'm running MacOS X 10.3.9 on a Mac Powerbook (with all of Apple's latest Security Updates installed. It is a virgin installation and no other software programs have been installed). I then installed Norton Personal Firewall 3.0.2 in order to monitor all my ports.
By default, Norton Personal Firewall (NPF) is not set to log the number of outgoing connections for port 80, although port 80 is the port typically used by most web browsers to contact other sites on the web. If you disable port 80, then your browser will not be able to function or access the web. Therefore it is mandatory that you leave that port open. But what if some unknown hacker wrote a Trojan program to specifically ferry information out of your computer and back to him using that port, then there'd be no way to stop it once the Trojan was in place. If you disabled the port to prevent it, then you'd also disable yourself from the web. If you opened the port for your browser, then the trojan would have free and open access. At least that is the theory that has me wondering about the seemingly high number of outgoing port 80 connections displayed in my NPF logging window. Therefore, I'd very much like to find out if other users who are running a version of Panther with NPF are experiencing the same high connections behavior on port 80.
To create the scenario for this behavior, basically you just open your NPF panel and enable all logging for port 80 (by default it is disabled). For those of you who don't specifically know how to do this, the following is the directions . . .
. . . Open your NPF Service Settings pane. From this pane, highlight the service called Web Sharing Port 80. Click the Edit button at the bottom of the selection window. A new pane will then show the controls named Ports, Logging, and Notification. Bring forward the Logging controls and enable both checkboxes for Allowed and Denied for the Outgoing direction. Click Save and close the window.
Once the above is done, close all other windows and open your NPF Logging window on your desktop and keep it visible for you to look at. Clear all existing entries in the log so you'll start with a clean slate. With everything set up and a web connection available, open your Safari browser (or any browser) to an online web site. On my computer, my Safari bowser is set to open to Apple's website - www.apple.com. Once the browser is open, Apple's website is then displayed.
The result . . . surprisingly, after only a few seconds, a HUGE number of port 80 TCP connections to that website address start to show up and flow into my log. In a matter of only 3 or 4 seconds, at least 250 separate TCP connection entries will show up in my log, and they all have the same web address. If I then click on anything on the page or surf to any other website, the log entries will change to the new site address and start up again, and in some cases, in a matter of less than a minute the number of entries can easily reach into the thousands. I've seen 20,000 entries or more flow into my log after a couple of minutes. And the only way to stop the madness and the entries is to disconnect from the web. Those many entries and this behavior does not seem normal to me, no matter what port is selected and no matter what log settings are enabled. A dozen to 15 or 20 entries for a given site I can understand (I've been told some browsers can open at least 10 connections at a time), but hundreds to thousands, I cannot. I can't understand why any program under any circumstance would need to generate those many log entries in such a short time frame. My problem is I have nothing to compare this data to, I only have my suspicions and have no way of knowing whether this behavior is normal or not. So I am asking for others to make a comparison on their computer if you are running any version of Panther and Norton Personal Firewall and give me your results so I can determine what is normal or not. I've heard of certain hacker attacks called TCP flooding and other forms of attacks, and I don't want my computer to have been secretly taken over by a hacker or the initiator of such attacks unknowingly. Furthermore, this is not anything an average user would even normally notice, simply because Port 80 logging is not usually enabled in NPF. Nevertheless, I need to find out the root of this problem and learn whether this is normal. Other than these high number of connection entries, my web surfing seems normal and I haven't yet experienced any seeming sluggishness accessing sites. Any help anyone can offer I would appreciate. Thanks to everyone in advance.
Here are some images of my own settings and results:
http://homepage.mac.com/starshone/misc/Port80Settings.jpg
http://homepage.mac.com/starshone/misc/Port80Log.jpg
  Mac OS X (10.3.9)  

Answer 1

But all those connections are how the web works. Each HTML page has dozens or more links. Each graphic or other page element is a new HTTP request on port 80 back to the originating server (or another server even). So it's normal to have a lot of port 80 connections going out if you surf the web.
You can see the individual elements that make up a page in Safari by going to the "Window" menu and showing the "Activity" window. I see CNN's web site tonight has 113 items on its home page. Apple's is 41. My home page is 10. So it's easy to get a lot of connections.
Some applications also use port 80 to check for updates, so you might see the occasional port 80 connection even when you're not surfing the web. These are also nothing to worry about.
charlie