Windows process from PID

Question

I am trying to determine which application or system program is using a specific port on a Windows 2008 R2 machine.

I ran

netstat -a -n -o 

And they determined that the PID holds the open port 445, which interests me.

But when I run tasklist or Microsoft pslist, it tells me that the process containing the open port is simply called "Sys".

Is there any other tool or approach that I can use to search, which is the real process supporting it?

Answer 1

PID 4 - system process - if PID 4 keeps the port open, it means that some device driver has opened the port. Given that this is port 445, I assume it is a network file system or a CIFS server. Try running "net stop srv" and "net stop rdr" from an elevated command prompt - this should close the service using the port.

Answer 2

The sysinternals procexp (process explorer) tool shows both processes, and if the process is a service, it can show which services are running in the same process. (Windows service processes may contain multiple service flows).

Port 445 is typically an SMB port for operations and file sharing on Windows, etc.

Answer 3

Have you looked at TCPView http://technet.microsoft.com/en-us/sysinternals/bb897437 ? This is another tool from sysinternals.

Answer 4

There is a free tool on the Nirsoft website called "CPORTS" with 32-bit and 64-bit versions that can help you. Port 445 is used by the 2008 R2 server, and then for communication with other systems using SAMBA / TCP. I got the list below from "cyberciti.biz"

■ netbios-ns - 137 / tcp # NETBIOS name service ■ netbios-dgm - 138 / tcp # NETBIOS datagram service ■ netbios-ssn - 139 / tcp # NETBIOS session service ■ microsoft-ds - 445 / tcp # if you are using Active Directory ■ Port 389 (TCP) - for LDAP (Active Directory mode) ■ Port 445 (TCP) - NetBIOS was ported to 445 after 2000 and beyond (CIFS) ■ Port 901 (TCP) - for SWAT (not related to client) communication

If you can run grep, this is their recommended format: $ grep -i NETBIOS / etc / services. If not, AstroGrep is a little more user friendly. Both can be obtained from SourceForge. My own interest is that some systems cannot map network drives to the 2008 R2 server, but they have no problem connecting a VPN and running SQL software on the same server. Port 445 is the one that I am most closely considering due to the needs of NETBIOS, but I really have no clue. One person may not be able to match the letter from the laptop on their home Internet site, but then use their mobile phone as an attached modem and display it without any problems. The same system as everything else.

I hope one of them helps you, since my problem is still ongoing, but the Nirsoft tool is the easiest to use, and the use of grep listed has given me other information that may come in handy. The tool from Nirsoft provides an excellent map of all used ports and a lot of other information. It does not require installation and is small enough to support flash drive. Grep or Astrogrep from SourceForge.

Happy holidays