I am investigating a production system where there are several Windows services communicating with each other through TCP/IP sockets. I'm trying to figure out which executable is listening to which IP address and which port on a given machine.
Other than rummaging through each windows service's obscure configuration files, is there a system tool that can more easily give me the details I want?
As already mentioned TCPView by SysInternals (i.e. Microsoft) is a great tool. But on production systems you may not be allowed to install additional software, so I think you may want to try out netstat.exe, which is typically located at C:\WINNT\system32\netstat.exe .
A help page is available with
netstat -?
Examples are:
netstat -a
Lists all local TCP connections and listening ports together with remote TCP endpoint.
netstat -o
Adds the process ID to the output.
netstat -b
Gives you the name of the executable wich was involved in establishing this connection/port.
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With