How do I find out what service is using a certain port?

Question

Port 22 specifically. I installed freeSSHd on a Windows Server 2008 box that only runs IIS. When I try to start the SSH Service, it tells me that the port is already being used. How can I find out what service is using this port?

Answer 1

Sysinternals TCPView will show you TCP/UDP ports that are in use and the processes that are using them.

Answer 2

netstat -b in the command prompt will also work. Sysinternals TCPView is basically a prettier GUI version, netstat is a tool that comes with Windows.

Sample output:

Active Connections

  Proto  Local Address          Foreign Address        State           PID
  TCP    john:2817              localhost:2818         ESTABLISHED     972
  [firefox.exe]

  TCP    john:2818              localhost:2817         ESTABLISHED     972
  [firefox.exe]

  TCP    john:2821              localhost:2822         ESTABLISHED     972
  [firefox.exe]

  TCP    john:2822              localhost:2821         ESTABLISHED     972
  [firefox.exe]

  TCP    john:3177    peak-colo-196-219.peak.org:http  ESTABLISHED     972
  [firefox.exe]

  TCP    john:3182    peak-colo-196-219.peak.org:http  ESTABLISHED     972
  [firefox.exe]

  TCP    john:2879              67.69.247.70:http      CLOSE_WAIT      972
  [firefox.exe]

  TCP    john:2880              67.69.247.70:http      CLOSE_WAIT      972
  [firefox.exe]

  TCP    john:2881              67.69.247.70:http      CLOSE_WAIT      972
  [firefox.exe]

  TCP    john:2882              67.69.247.70:http      CLOSE_WAIT      972
  [firefox.exe]

  TCP    john:2883              67.69.247.70:http      CLOSE_WAIT      972
  [firefox.exe]

  TCP    john:2884              67.69.247.70:http      CLOSE_WAIT      972
  [firefox.exe]

Answer 3

netstat -an will show all the ports which are currently open with their address in numerical form.
To find info about a particular port use via Power Shell's prompt as Administrator: netstat -an | Select-String 10000.

Answer 4

netstat in Windows 2008:

Start Command prompt with "Run as administrator", then type netstat -anb.

Command runs faster in numerical form (-n), and the -b option requires elevation.

To filter the output and check only udp ports: use netstat -anb -p udp

Answer 5

Take it to the next level with CurrPorts by NirSoft:

CurrPorts displays the list of all currently opened TCP/IP and UDP ports on your local computer. For each port in the list, information about the process that opened the port is also displayed, including the process name, full path of the process, version information of the process (product name, file description, and so on), the time that the process was created, and the user that created it.

Not only that but:

In addition, CurrPorts allows you to close unwanted TCP connections, kill the process that opened the ports, and save the TCP/UDP ports information to HTML file , XML file, or to tab-delimited text file. CurrPorts also automatically mark with pink color suspicious TCP/UDP ports owned by unidentified applications (Applications without version information and icons)

Answer 6

Run netstat –ano | find “0.0.0.0:22” under the evaluated rights and get the process ID (number in the last column).

Then use Task Manager (Ctrl+Shift+Esc) to identify process. If it doesn't show PID column then turn it on (“View” > “Select Columns” > “PID (Process identifier)”)

Answer 7

Windows Resource Monitor (not Widows performance monitor, or the monitor from the task manager) will also show the port and PID of all open connections.

Start --> Search --> "Resource Monitor" --> Netowrk tab