Windows tool to find out which port an app is trying to use?

Question

I am guessing that netstat shows apps and their ports that already have a connection and it doesn't show or can't show an app that is trying to open a connection.

If I have an app that's trying to connect to the net but is blocked by a firewall, how do I know which port it's trying to use?

Solution 1

You can use TCPView from Microsoft/Sysinternals.

If you find it difficult to capture the port opening with that utility, than the best bet is to install and run Wireshark to get a network trace (assume you aren't talking about a local software-based firewall.

Solution 2

Windows tool to find out which port an app is trying to use?

NirSoft's CurrPorts - network monitoring software that displays the list of all currently opened TCP/IP and UDP ports on your local computer. For each port in the list, information about the process that opened the port is also displayed, including the process name, full path of the process, version information of the process (product name, file description, and so on), the time that the process was created, and the user that created it.

CurrPorts allows you to close unwanted TCP connections, kill the process that opened the ports, and save the TCP/UDP ports information to HTML file , XML file, or to tab-delimited text file. CurrPorts also automatically mark with pink color suspicious TCP/UDP ports owned by unidentified applications (Applications without version information and icons)

Solution 3

If it's a software firewall then make an exception for the whole application so that you can easily check with netstat or tcpview which port it's using. After that you can remove the exception and add a rule for that specific port

Comments

[Chris W. Rea]

For what operating system?

[Tony_Henrich]

Sorry.. for Windows

[Tony_Henrich]

Can't do that. It's a firewall at work which I don't have access to.

[Dentrasi]

TCP view is pretty much a frontend for netstat; if the program can't connect, I don't think you'll see in in that. Wireshark is what you want.

[AshleyF]

That depends. If the firewall is not closing the connection (just dropping packets), then TCPView will show SYN_SENT while it waits for the connection to be established. You can see the same in netstat, but you have to be quicker on the refresh.