1.How is it possible that processes have unknown paths?
The system knows the Process IDs. (Specifically, the networking stack must know this.) The process IDs are just unknown to netstat.
doesn't the system know the path of any process that establishes a connection?
Yes. When the TCP/IP stack (responsible for common protocols, including TCP and UDP and perhaps ICMP) receives information, it sends that information to programs. This ability permits your computer to have multiple conversations, with different pieces of software running on the system, and send incoming data to the correct conversation. TCP's design requires incoming data to be processed as part of the initializing handshake. UDP also supports this somewhat, which is why you can simultaneously make multiple DNS requests and the computer will know which response is meant to match with each request.
2.Is there another tool I haven't used or some other way to log the processes that establish connections in a clear way and with the paths of all the processes?
netstat -b
should be able to do that just fine. (This syntax is for modern versions of Microsoft Windows. Other netstat implementations may use different parameters.) The -n
parameter just eliminates Reverse DNS details, which people commonly eliminate (usually because it can slow things down).
The problem is likely an issue with permissions, which I would hope would also affect any other tools. (Otherwise, the expected security benefits may not be working as one would hope.)
Best bet: Make sure you're an Administrator. If you're using Windows Vista or newer, make sure that if UAC is enabled, then you're using an elevated command prompt.
netstat -nb
ought to show you PID numbers. Converting that to paths is done separately, e.g. with TASKLIST
or:
WMIC PROCESS GET Caption,CommandLine,Description,ExecutablePath,Name,ParentProcessId,ProcessId /FORMAT:VALUE