Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Port 22 specifically. I installed freeSSHd on a windows server 2008 box that only runs IIS. When i try to start the SSH Service, it tells me that the port is already being used. How can I find out what service is utilizing this port?

share|improve this question
add comment

5 Answers 5

up vote 14 down vote accepted

Sysinternals TCPView will show you TCP/UDP ports that are in use and the processes that are using them.

alt text

share|improve this answer
    
(An image-only answer isn't index-friendly :-) TCPView, the tool shown, can be found here: technet.microsoft.com/en-us/sysinternals/bb897437.aspx –  Chris W. Rea Aug 21 '09 at 16:47
    
@cwrea: Had trouble with the link -- fixed now. –  arathorn Aug 21 '09 at 16:47
    
+1 for Sysinternals. I've always used netstat -ab and it has worked for me but this is definitely better. –  Hondalex Aug 21 '09 at 17:24
add comment

netstat -b in the command prompt will also work. Sysinternals TCPView is basically a prettier GUI version, netstat is a tool that comes with Windows.

Sample output:

Active Connections

  Proto  Local Address          Foreign Address        State           PID
  TCP    john:2817              localhost:2818         ESTABLISHED     972
  [firefox.exe]

  TCP    john:2818              localhost:2817         ESTABLISHED     972
  [firefox.exe]

  TCP    john:2821              localhost:2822         ESTABLISHED     972
  [firefox.exe]

  TCP    john:2822              localhost:2821         ESTABLISHED     972
  [firefox.exe]

  TCP    john:3177    peak-colo-196-219.peak.org:http  ESTABLISHED     972
  [firefox.exe]

  TCP    john:3182    peak-colo-196-219.peak.org:http  ESTABLISHED     972
  [firefox.exe]

  TCP    john:2879              67.69.247.70:http      CLOSE_WAIT      972
  [firefox.exe]

  TCP    john:2880              67.69.247.70:http      CLOSE_WAIT      972
  [firefox.exe]

  TCP    john:2881              67.69.247.70:http      CLOSE_WAIT      972
  [firefox.exe]

  TCP    john:2882              67.69.247.70:http      CLOSE_WAIT      972
  [firefox.exe]

  TCP    john:2883              67.69.247.70:http      CLOSE_WAIT      972
  [firefox.exe]

  TCP    john:2884              67.69.247.70:http      CLOSE_WAIT      972
  [firefox.exe]
share|improve this answer
1  
Agreed, although I find the live-updating/highlighting in TCPView to be quite useful in tracking ports/processes down. –  arathorn Aug 21 '09 at 17:01
    
TCPView is better no doubt, although if he wants to avoid a download this is an alternative. –  John T Aug 21 '09 at 17:03
    
Yeah, definitely. –  arathorn Aug 21 '09 at 17:04
    
+1 For the simplicity but TCPView is better with it's GUI –  Hondalex Aug 21 '09 at 17:25
    
+1 for the builtin solution. "Use sysinternals" seems to be the answer to every Windows question here, but it's good to know how to solve problems without 3rd party software. –  John Fouhy Aug 22 '09 at 2:06
add comment

netstat in Windows 2008:

Start Command prompt with "Run as administrator", then type netstat -anb.

Command runs faster in numerical form (-n), and the -b option requires elevation.

To filter the output and check only udp ports: use netstat -anb -p udp

share|improve this answer
add comment

Take it to the next level with CurrPorts by NirSoft:

CurrPorts displays the list of all currently opened TCP/IP and UDP ports on your local computer. For each port in the list, information about the process that opened the port is also displayed, including the process name, full path of the process, version information of the process (product name, file description, and so on), the time that the process was created, and the user that created it.

Not only that but:

In addition, CurrPorts allows you to close unwanted TCP connections, kill the process that opened the ports, and save the TCP/UDP ports information to HTML file , XML file, or to tab-delimited text file. CurrPorts also automatically mark with pink color suspicious TCP/UDP ports owned by unidentified applications (Applications without version information and icons)

alt text

share|improve this answer
add comment

netstat -an will show all the ports which are currently open with their address in numerical form.
To find info about a particular port use netstat -an | grep PORTNO.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.