CODEWITHSUNDEEP
windows-services
urig
urig

Reputation: 16831

Investigating which Windows service is listening to which IP and port

I am investigating a production system where there are several Windows services communicating with each other through TCP/IP sockets. I'm trying to figure out which executable is listening to which IP address and which port on a given machine.

Other than rummaging through each windows service's obscure configuration files, is there a system tool that can more easily give me the details I want?

Upvotes: 17

Views: 77322

Answers (5)

mkoeller
mkoeller

Reputation: 4477

As already mentioned TCPView by SysInternals (i.e. Microsoft) is a great tool. But on production systems you may not be allowed to install additional software, so I think you may want to try out netstat.exe, which is typically located at C:\WINNT\system32\netstat.exe .

A help page is available with 

netstat -?

Examples are:

netstat -a

Lists all local TCP connections and listening ports together with remote TCP endpoint.

netstat -o

Adds the process ID to the output.

netstat -b

Gives you the name of the executable wich was involved in establishing this connection/port.

Upvotes: 40

urig
urig

Reputation: 16831

Thanks everyone. Very helpful indeed. A friend also introduced me to a freeware utility called "Active Ports" from DeviceLock: http://www.devicelock.com/freeware.html/

Upvotes: 0

Zoredache
Zoredache

Reputation: 39593

Give this a whirl.

netstat -abn

Upvotes: 3

Gordon Thompson
Gordon Thompson

Reputation: 4834

http://technet.microsoft.com/en-us/sysinternals/bb897437.aspx

SysInternals TCPView is great

Upvotes: 9

begray
begray

Reputation: 16221

Command line netstat tool might help you. To learn available parameters run it with /?: netstat /?

Or there is a better GUI alternative: SysInternals TcpView (freely downloadable from ms site)

Upvotes: 0

Related Questions