This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Correlating a netstat connection with a service

0

Hello all,

I have some servers in my network talking to what looks like a Microsoft server in washington on port 443.

I'v tracked down the PID in netstat however it looks like the PID belongs to almost a dozen services

Wuauserv, winmgmt, themes, ShellHWDetection, SesionEnv, SENS, Schedule, Profsvc, LanmanServer, CertPropSvc, BITS and AppInfo. I'm currently stuck at trying to figure out what service is specifically

Would you know of any applications that would help align an ip/port in netstat to a specific service?

Thanks for your help!

asked 18 Sep '15, 13:45

forkbomb's gravatar image

forkbomb
0112
accept rate: 0%


2 Answers:

1

I know the build in commands

tasklist /svc

tasklist /v

netstat -b

answered 18 Sep ‘15, 14:30

Christian_R's gravatar image

Christian_R
1.8k2625
accept rate: 16%

1

Hi,

The easiest way to do this is with Sysinternal Process Explorer which you can freely download from Microsoft. Once you've started Process Explorer you'll get a tree diagram showing all of the processes. Look down the PID column to find the process that interests you.

alt text

Next select the TCP/IP tab and you'll see which TCP and UDP ports the process is using and the associated services.

alt text

As you can see, the Local Address shows the port number. I hope this helps.

Best regards...Paul

answered 19 Sep '15, 01:29

PaulOfford's gravatar image

PaulOfford
131283237
accept rate: 11%

edited 19 Sep '15, 01:30

THANK YOU!

I found the issue, device setup manager was reaching out to microsoft & akamai servers. However, this is slightly concerning. Is this normal behavior for this service? It seems like it is 'Enables the detection , download and installation of device-related software' however just wanted to get a second opinion.

(21 Sep '15, 17:08) forkbomb