Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm redoing my firewall configuration with more restrictive policies and I would like to determine the provenance (and/or destination) of some outgoing connections.

I have an issue because they come from svchost.exe and go to web content/application delivery providers - or similar:

5 IP in range: 82.96.58.0 - 82.96.58.255      --> Akamai Technologies         akamaitechnologies.com
3 IP in range: 93.150.110.0 - 93.158.111.255  --> Akamai Technologies         akamaitechnologies.com
2 IP in range: 87.248.194.0 - 87.248.223.255  --> LLNW Europe 2               llnw.net
205.234.175.175                               --> CacheNetworks, Inc.         cachefly.net
188.121.36.239                                --> Go Daddy Netherlands B.V.   secureserver.net

So is it possible to know which service does a particular connection? Or what's your recommendation about the rules applied to these ones?

(Comodo Firewall & Windows 7)

Update:

netstat -ano & tasklist /svc help me a little but they are many services in one svchost.exe so it's still an issue. moreover the service names returned by "tasklist /svc" are not easy readable.

(All the connections are HTTP (port 80) but I don't think it's relevant)

share|improve this question

7 Answers 7

up vote 6 down vote accepted

I have found a method in this Server Fault answer (about services and memory usage) that I could use to analyze individually the network usage of services (with any network tool)

Peter Mortensen:

Split each service to run in its own SVCHOST.EXE process and the service consuming the CPU cycles will be easily visible in Task Manager or Process Explorer (the space after "=" is required):

SC Config Servicename Type= own

Do this in a command line window or put it into a BAT script. Administrative privileges are required and a restart of the computer is required before it takes effect.

The original state can be restored by:

SC Config Servicename Type= share
share|improve this answer

TCPView is a graphic tool that will show you the service, PID, and TCP connection (both local and remote) :

image

share|improve this answer
    
Like 'netstat -ano & tasklist /svc' this tool distincts different connections in one svchost PID but doesn't show which service is behind them... It's already better because it links PID & connections (and recognize some well-know ports) but it's still not what I'm looking for. (Moreover it lacks of filters and logs features...) –  fluxtendu Mar 22 '10 at 15:30

try using tasklist /svc and netstat or netstat -an from the command line. This will show you the programs that are using svchost.exe and the ports being. Using the port numbers, you may be able to look up the protocol that commonly uses the number http://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers.

share|improve this answer

SysInternals Process Explorer can do this for you.

Open the process properties of the svchost.exe instance you are trying to analyze. Click on the TCP/IP tab. Double click on the connection you are wanting to discover to bring up a stack trace of the connection. You should be able to trace the stack back to the DLL that implements the service. Here is an excerpt from the help file on the topic of Process Properites:

TCP/IP:

Any active TCP and UDP endpoints owned by the process are shown on this page.

On Windows XP SP2 and higher this page includes a Stack button that opens a dialog that shows the stack of the thread that opened the selected endpoint at the time of the open. This is useful for identifying the purpose of endpoints in the System process and Svchost processes because the stack will include the name of the driver or service that is responsible for the endpoint

Also on Configuring Symbols

Configure Symbols: on Windows NT and higher, if you want Process Explorer to resolve addresses for thread start addresses in the threads tab of the process properties dialog and the thread stack window then configure symbols by first downloading the Debugging Tools for Windows package from Microsoft's web site and installing it in its default directory. Open the Configure Symbols dialog and specify the path to the dbghelp.dll that's in the Debugging Tools directory and have the symbol engine download symbols on demand from Microsoft to a directory on your disk by entering a symbol server string for the symbol path. For example, to have symbols download to the c:\symbols directory you would enter this string:

srv*c:\symbols*http://msdl.microsoft.com/download/symbols

Note: You may need to run Process Explorer as administrator to be able to see the thread's stack.

share|improve this answer
    
Very interesting, but unfortunately PE v11.33 appears to not support TCP/IP stacks on Windows 7 :-/ "Stacks not available on this version of Windows". I don't have found confirmation on the web but I'm pretty sure I have configured Symbols correctly... –  fluxtendu Mar 24 '10 at 2:37
    
Same result with the new PE 12 :-/ –  fluxtendu Mar 26 '10 at 16:12
    
Hmm.. I get the same on 7. Strange it works fine on XP. –  heavyd Mar 26 '10 at 18:11
1  
The TCP/IP tab should have a "Service" column which, for example while looking at an instance of svchost.exe, tells you which service owns each connection (among the services grouped under the same PID). Right now I'm using PE 12.00, and at this moment I can't check whether the "Service" column was there in the previous version, but it should be worth a try. –  TataBlack Mar 28 '10 at 23:02

Use the task manager to view the PID columns for each process in the process list. Then run netstat -ano to view the active connections and associated PID (= process id).

share|improve this answer

The NirSoft utility CurrPorts does everything you want, including filtering and giving the list of services of a process.

In fact, the only problem with it is how to choose among the enormous number of information columns that it can potentially display.

image

share|improve this answer
    
It's the best solution so far but doesn't do the essential thing I'm looking for: The "Process Services" column groups all the possible services... –  fluxtendu Mar 22 '10 at 18:24

I know this may be outdated, but still this page ranks high in search for "svchost connections", so I'll toss my input here. There is tool called Svchost Process Analyzer, it may help: http://www.neuber.com/free/svchost-analyzer/index.html

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.