Finding service that is holding port 8443

Question

I have executed the following command to get better idea of what is holding the port 8443 on server I'm trying to work on and install some new software on it.

C:\Users\Administrator>netstat -abn | find "8443"
TCP    0.0.0.0:8443           0.0.0.0:0              LISTENING
TCP    [::]:8443              [::]:0                 LISTENING

Any ideas on how to link this to specific service?

the binary without the find is coming up as:

Can not obtain ownership information

Solution 1

Drop the pipe to find. Irritatingly, the application is on a new line, so you can't use the find utility.

For example:

C:\Windows\system32>netstat -abn | find "3306"
  TCP    0.0.0.0:3306           0.0.0.0:0              LISTENING
  TCP    [::]:3306              [::]:0                 LISTENING

And without the pipe to find (snipped for brevity)

C:\Windows\system32>netstat -abn
  TCP    0.0.0.0:3306           0.0.0.0:0              LISTENING
 [mysqld.exe]

What you could do is output to a text file (i.e netstat -abn > netstat.txt) and use the search in Notepad to find 8433 and see what executable is listening on the port that way.

If you get Can not obtain ownership information in the output, give it a minute and run the command again. As crazy as that sounds, it happened to me while I was doing the test for this answer. Doing nothing but waiting 30 seconds and running the exact same netstat command again then showed the executable.

Solution 2

Check out TCPView

http://technet.microsoft.com/en-us/sysinternals/bb897437

TCPView is a Windows program that will show you detailed listings of all TCP and UDP endpoints on your system, including the local and remote addresses and state of TCP connections. On Windows Server 2008, Vista, and XP, TCPView also reports the name of the process that owns the endpoint. TCPView provides a more informative and conveniently presented subset of the Netstat program that ships with Windows. The TCPView download includes Tcpvcon, a command-line version with the same functionality.

Comments

[MatBanik]

I get following without the find: Can not obtain ownership information any ideas?

[Ben Pilbrow]

@MatBanik Maybe try it again? Seriously though, I got the Can not obtain ownership information error, and when I ran the exact same command again about 10 seconds later it showed me the process name.

[MatBanik]

Interesting let me write batch that will output the command every 3 minutes and see what happens.

[Ben Pilbrow]

If that doesn't work, TCPView is a really nifty utility which I forgot all about. See @ckliborn's answer for the link to that.

[MatBanik]

You were right! It showed [Dropbox.exe]

[Ben Pilbrow]

Heh, Windows is crazy :/

[Flanfl]

I had the same problem, if the PID of that process is 4 it means that SYSTEM is bound to that port as explained here: social.technet.microsoft.com/Forums/en-US/winservergen/threa‌​d/…