Which executable is listening on a port

So you know that something is listening on TCP port 1120 on your server, but how to determine what it is?
You could look it up, but that list doesn’t include every piece of software, by far. And in any case, is it correct on your server? Ports can usually be changed, as well as shared between different manufacturers products.

Better to trace it and be able to determine it definitively.

These instructions are for Windows Server 2008 (inc R2, Vista, and Windows 7).

  1. Open a command prompt, use:
    netstat -aon | find “<port number>”
    e.g. for port 1120:
    netstat -aon | find "1120"
    TCP 0.0.0.0:1120 0.0.0.0:0 LISTENING 4736
  2. This gives you the Process ID (PID) for the process that listening on that port. In the example above, PID 4736 is listening on port 1120.
  3. Open Task Manager, go to the Processes tab. Ensure the PID column is visible, if not turn it on (View, Select Columns…, tick PID).
  4. Find the PID (e.g. 4736) from step 1, right-click that line and choose Open File Location.
  5. An Explorer window will open with the file selected.

Optional additional steps:

  1. Hold <Shift> and right-click the file, choose Copy as path.
  2. You now have the full path to the executable on the clipboard.
This entry was posted in Windows and tagged , , , , , , , , , . Bookmark the permalink.

One Response to Which executable is listening on a port

  1. Pingback: Add an Inbound Rule for an executable to Windows Firewall « Robin CM's IT Blog

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s