Who's listening to my ports?
A recent post on the newsgroup wanted to know how to determine what application may be listening out onto a port on outr network. Susan Bradley and David Copeland offered the following advice:
1. From a command line, type: netstat -ano . This will give you a list of TCP/UDP ports, their current state, and what Windows application (PID#) is attached. Here's an example of what you would see:
Proto Local Address Foreign Address State PID
TCP 0.0.0.0:135 0.0.0.0:0 LISTENING 1028
TCP 0.0.0.0:3389 0.0.0.0:0 LISTENING 952
TCP 0.0.0.0:5800 0.0.0.0:0 LISTENING 532
2. Now, open up your Task Manager, click on View > Select Columns, and click to enable PID (Process Identifier). You will now find a new columnd (PID) added to your list of active processes. Click on the PID column header to sort the list of processes in ascending PID number order.
In my example, I was curious about port 5800 / PId 532. Task Maanager reported that “winvnc.exe“ was using it.
3. Another command line prompt you may wish to check out is: tasklist /svc . The result is a list of processes and PID numbers, like this:
Image Name PID Services
==================== ==== ===========================
System Idle Process 0 N/A
System 4 N/A
smss.exe 552 N/A
csrss.exe 680 N/A
winlogon.exe 704 N/A
services.exe 756 Eventlog, PlugPlay
lsass.exe 768 Netlogon, PolicyAgent, ProtectedStorage, SamSs
svchost.exe 952 DcomLaunch, TermService
svchost.exe 1028 RpcSs
svchost.exe 1100 AudioSrv, CryptSvc, Dhcp, dmserver, ERSvc,
svchost.exe 1144 Dnscache
4. You can also concatenate the netstat or tasklist commands with the find command, if you have a specific PID number you are looking for, like this:
netstat -aon | find ":3389"
tasklist /svc | find "nnn"
5. Finally, check out KB 832017 for more information on Service overview and network port requirements for the Windows Server system: