Correlating a netstat connection with a service

Question

Hello all,

I have some servers in my network talking to what looks like a Microsoft server in washington on port 443.

I'v tracked down the PID in netstat however it looks like the PID belongs to almost a dozen services

Wuauserv, winmgmt, themes, ShellHWDetection, SesionEnv, SENS, Schedule, Profsvc, LanmanServer, CertPropSvc, BITS and AppInfo. I'm currently stuck at trying to figure out what service is specifically

Would you know of any applications that would help align an ip/port in netstat to a specific service?

Thanks for your help!

Answer 1

I know the build in commands

tasklist /svc tasklist /v

netstat -b

Answer 2

Hi,

The easiest way to do this is with Sysinternal Process Explorer which you can freely download from Microsoft. Once you've started Process Explorer you'll get a tree diagram showing all of the processes. Look down the PID column to find the process that interests you.

alt text

Next select the TCP/IP tab and you'll see which TCP and UDP ports the process is using and the associated services.

alt text

As you can see, the Local Address shows the port number. I hope this helps.

Best regards...Paul