12
6
I am guessing that netstat shows apps and their ports that already have a connection and it doesn't show or can't show an app that is trying to open a connection.
If I have an app that's trying to connect to the net but is blocked by a firewall, how do I know which port it's trying to use?
Tony_Henrich
Posted 2009-09-02T19:42:44.333
Reputation: 9 154
12
dlux
Posted 2009-09-02T19:42:44.333
Reputation: 4 183
TCP view is pretty much a frontend for netstat; if the program can't connect, I don't think you'll see in in that. Wireshark is what you want. – Dentrasi – 2009-09-02T20:23:40.443
1That depends. If the firewall is not closing the connection (just dropping packets), then TCPView will show SYN_SENT while it waits for the connection to be established. You can see the same in netstat, but you have to be quicker on the refresh. – dlux – 2009-09-02T20:35:20.793
6
Windows tool to find out which port an app is trying to use?
NirSoft's CurrPorts - network monitoring software that displays the list of all currently opened TCP/IP and UDP ports on your local computer. For each port in the list, information about the process that opened the port is also displayed, including the process name, full path of the process, version information of the process (product name, file description, and so on), the time that the process was created, and the user that created it.
CurrPorts allows you to close unwanted TCP connections, kill the process that opened the ports, and save the TCP/UDP ports information to HTML file , XML file, or to tab-delimited text file. CurrPorts also automatically mark with pink color suspicious TCP/UDP ports owned by unidentified applications (Applications without version information and icons)
1
If it's a software firewall then make an exception for the whole application so that you can easily check with netstat or tcpview which port it's using. After that you can remove the exception and add a rule for that specific port
Paxxi
Posted 2009-09-02T19:42:44.333
Reputation: 6 952
Can't do that. It's a firewall at work which I don't have access to. – Tony_Henrich – 2009-09-02T20:22:35.873
0
From the command line you can use
netstat -ano
Then look at the Task Manager to see which PID corresponds to which port
mainstringargs
Posted 2009-09-02T19:42:44.333
Reputation: 187
Tried that and it didn't work thus my question. I ran a program which was trying to connect to the net and then the netstat command and tasklist | findstr pid and the app didn't show up. My conclusion is netstat shows established connections only. – Tony_Henrich – 2009-09-03T04:21:53.260
0
netstat -b -a
seems to work
-a Displays all connections and listening ports.
-b Displays the executable involved in creating each connection or listening port. In some cases well-known executables host multiple independent components, and in these cases the sequence of components involved in creating the connection or listening port is displayed. In this case the executable name is in [] at the bottom, on top is the component it called, and so forth until TCP/IP was reached. Note that this option can be time-consuming and will fail unless you have sufficient permissions.
Jason Erkie
Posted 2009-09-02T19:42:44.333
Reputation: 1
For what operating system? – Chris W. Rea – 2009-09-02T19:52:12.567
Sorry.. for Windows – Tony_Henrich – 2009-09-02T19:57:19.717