Tuesday, April 26, 2016

Netstat to view open ports and applications


To determine what service/application is running on any open port

Open command prompt as Administrator and use the following netstat command to export to a easier to read and search txt file:

netstat -a -n -b >c:\portresults.txt

then open c:\portresults.txt and you will see:

Active Connections

  Proto  Local Address          Foreign Address        State           PID

[Application]

For Example:

[spoolsv.exe]
  TCP    0.0.0.0:496xx          0.0.0.0:0              LISTENING
[lsass.exe]
  TCP    10.xx.xx.112:139         0.0.0.0:0              LISTENING
[mms_mini.exe]
  TCP    10.xx.xx.112:58x0x       13x.25x.x34.232:443     ESTABLISHED
[Explorer.EXE]
  TCP    10.xx.xx.112:58x2x       13x.25x.x34.232:443     ESTABLISHED
[OneDrive.exe]
  TCP    10.xx.xx.112:60x8x       7x.94x.x71.4:443      ESTABLISHED
[lync.exe]
  TCP    10.xx.xx.112:60x4x       7x.94x.x71.4:443        ESTABLISHED
[lync.exe]
  TCP    10.xx.xx.112:62x2x       7x.94x.x71.4:443        TIME_WAIT
  TCP    10.xx.xx.112:6x9x5       7x.94x.x71.4:443        ESTABLISHED
[OUTLOOK.EXE]
  TCP    10.xx.xx.112:6xx28       7x.94x.x71.4:443        ESTABLISHED

No comments:

Post a Comment