This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hello all,

I have some servers in my network talking to what looks like a Microsoft server in washington on port 443.

I'v tracked down the PID in netstat however it looks like the PID belongs to almost a dozen services

Wuauserv, winmgmt, themes, ShellHWDetection, SesionEnv, SENS, Schedule, Profsvc, LanmanServer, CertPropSvc, BITS and AppInfo. I'm currently stuck at trying to figure out what service is specifically

Would you know of any applications that would help align an ip/port in netstat to a specific service?

Thanks for your help!

asked 18 Sep '15, 13:45

forkbomb's gravatar image

forkbomb
0112
accept rate: 0%


I know the build in commands

tasklist /svc

tasklist /v

netstat -b
permanent link

answered 18 Sep '15, 14:30

Christian_R's gravatar image

Christian_R
1.8k2625
accept rate: 16%

Hi,

The easiest way to do this is with Sysinternal Process Explorer which you can freely download from Microsoft. Once you've started Process Explorer you'll get a tree diagram showing all of the processes. Look down the PID column to find the process that interests you.

alt text

Next select the TCP/IP tab and you'll see which TCP and UDP ports the process is using and the associated services.

alt text

As you can see, the Local Address shows the port number. I hope this helps.

Best regards...Paul

permanent link

answered 19 Sep '15, 01:29

PaulOfford's gravatar image

PaulOfford
131273237
accept rate: 11%

edited 19 Sep '15, 01:30

THANK YOU!

I found the issue, device setup manager was reaching out to microsoft & akamai servers. However, this is slightly concerning. Is this normal behavior for this service? It seems like it is 'Enables the detection , download and installation of device-related software' however just wanted to get a second opinion.

(21 Sep '15, 17:08) forkbomb
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×1,620
×6

question asked: 18 Sep '15, 13:45

question was seen: 3,763 times

last updated: 21 Sep '15, 17:08

p​o​w​e​r​e​d by O​S​Q​A