Re: Port usage and associated process

From: Michel Gallant (MVP) (neutron@istar.ca)
Date: 11/01/02 

Date: Fri, 01 Nov 2002 12:57:33 -0500
From: "Michel Gallant (MVP)" <neutron@istar.ca>

Thanks Gary. Fport and related info. is what I was looking for.

However, it does NOT report those 2 NAV 2002 ports (25 SMTP, 110 POP3)
that are listening (as verified by the Java port-scan utility):
   http://home.istar.ca/~neutron/localportscan
Nice page (pfw.shtml). You might also want to include this reference:
  "Default Processes in Win2000":
  http://support.microsoft.com/default.aspx?scid=KB;EN-US;Q263201

 - Michel Gallant
   MVP Security
   http://home.istar.ca/~neutron

Gary Flynn wrote:

> "Michel Gallant (MVP)" wrote:
> >
> > If I do a localhost tcp portscan on a win32 system and find a particular
> > port being used for listening, what tools can I use to find out which
> > **process/service** is using that particular port?
> > Particularly interested in Win2000+
>
> NT/2000 Fport
> XP netstat -ano
>
> RPC services - portqry and tscan -s
>
> See the bottom section of this for links:
>
> http://www.jmu.edu/computing/security/info/pfw.shtml#comms
>
> --
> Gary Flynn
> Security Engineer - Technical Services
> James Madison University
>
> Please R.U.N.S.A.F.E.
> http://www.jmu.edu/computing/runsafe

Relevant Pages

  • Re: Hidden Services Scanner Required
    ... Fport can show you what IP ports are open and listening and which programs ... The book Incident Response is helpful in cases like these. ...
    (microsoft.public.win2000.security)
  • Re: 160 open connections!
    ... > A listening tcp port is a _server_, ... According to the Fport readme.txt: ...
    (comp.security.firewalls)
  • Re: Port usage and associated process
    ... Fport and related info. is what I was looking for. ... Do the ports show up ... in the LISTENING state with netstat? ... type of proxy to scan email messages and uses those ports to shuffle ...
    (microsoft.public.security)