So you know that something is listening on TCP port 1120 on your server, but how to determine what it is?
You could look it up, but that list doesn’t include every piece of software, by far. And in any case, is it correct on your server? Ports can usually be changed, as well as shared between different manufacturers products.
Better to trace it and be able to determine it definitively.
These instructions are for Windows Server 2008 (inc R2, Vista, and Windows 7).
- Open a command prompt, use:
netstat -aon | find “<port number>”
e.g. for port 1120:
netstat -aon | find "1120"
TCP 0.0.0.0:1120 0.0.0.0:0 LISTENING 4736
- This gives you the Process ID (PID) for the process that listening on that port. In the example above, PID 4736 is listening on port 1120.
- Open Task Manager, go to the Processes tab. Ensure the PID column is visible, if not turn it on (View, Select Columns…, tick PID).
- Find the PID (e.g. 4736) from step 1, right-click that line and choose Open File Location.
- An Explorer window will open with the file selected.
Optional additional steps:
- Hold <Shift> and right-click the file, choose Copy as path.
- You now have the full path to the executable on the clipboard.