How to determine what process has opened which port for Windows.
Any application can use any free port. There are some rules around ports but they are loosely followed / enforced.
You will need to look while the port is in use to determine what is opening the port. I use the command line tools but you can use the GUI tools.
tasklist - Windows OS command line tool.
netstat - Windows OS command line tool.
pslist - SysInternals tool available from Micrososft. command line
portmon - SysInternals tool available from Micrososft. GUi
procexp - SysInternals tool available from Micrososft. GUI
procmon - SysInternals tool available from Micrososft. GUI
Open a command prompt (preferably with administrator rights)
Run and capture the output to files for analisys with these commands:
- tasklist /v > Tasks.txt
- tasklist /svc > SVC_List.txt
- netstat -aon > Port_List.txt
You can also run the PSLIST tool for information
- pslist -m > PSLIST_M.txt
- pslist -t > PSLIST_T.txt
You can look up the process associated with the port in the Port_List.txt to find the PID (Process ID). Then look in the TASKLIST (and PSLIST) capture files to determine what the PID references back to for determining what process (and application) opened the port. In some cases, you may need to use PROCEXP to find what started the process. PROCEXP looks into all subtasks where TASKLIST may not capture the information.
You can also run netstat with additional switchs for more information. The "o" option can take a while to run and can fail to complete under some circumstances. The leaving off the "n" option has NETSTAT try to resolve the IP address which slows down the process.
I suggest posting the information gathered if you need assistance looking deeper into determine the process.
Last Wiki Answer Submitted: September 23, 2011 5:19 pm by Pjb02223,310 pts.