Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I noticed by accident today that I have some unknown webserver listening on port 8000. Opening http://localhost:8000 just returns 404, so I don’t get any hint what exactly is listening there.

I’ve used netstat -ano to find out, that the process with PID 4 is listening on that port. PID 4 is the System process. Why is my system listening on that port, without me actually starting a server? Or how can I find out what exactly is listening there?

I’ve read the related questions about port 80 and port 443, but none of the services mentioned there were running on my system. And the other suggestions there didn’t work either.

edit:

The HTTP response of the server lists Microsoft-HTTPAPI/2.0 as the server.

edit2:

As requested by Shadok, here are the entries of TCPView with 8000 as the port. But I doubt it’s useful at all…

TCPView results

share|improve this question

4 Answers 4

up vote 9 down vote accepted

IIRC, any program that uses the HTTP Server API to run an HTTP server on Windows will have that service charged to the System process because it's running through the kernel's http.sys server.

You can see the registered URLs by running the following command: netsh http show servicestate. This will include the port number as well.

netsat -ab can also reveal which services started listening on a given port as well.

share|improve this answer
    
Thank you! I really should have thought of that myself… I figured out that it was VAIO Care (a Sony utility) who started the service (VCAgent.exe). But apparently that service is not really needed. I kept a network sniffer open to check if there are any requests to the server when clicking around in the program, but nothing really happened (the normal request in the webbrowser did appear). Anyway, I removed it from autostart, so this should be resolved now. Although it’s quite stupid that all the server API always uses the System process. –  poke Nov 22 '11 at 18:25
    
+1 for netstat -ab –  Kevin Kibler Dec 4 '13 at 15:26
    
Too bad my netstat -ab says "Can not obtain ownership information", so I'm stuck, but otherwise still a useful command –  Tominator Jul 4 at 7:39

A little late maybe but this thread came up quite high on my google search, and seemed most relevent though lacking that final piece of information i found useful.

You can see the (dynamically)registered url's by running the following command: netsh http show servicestate

share|improve this answer

A bit of googling shows WCF example applications using 8000, and the Intel Remote Desktop Interface. I wouldn't expect these to be running as system.

There are a few trojans / backdoors that use 8000, so perhaps booting an Antivirus disk and doing a full scan would be a good idea.

share|improve this answer

You could use TCPView to find out a lot more infos on that process than what you can find through netstat.
If you still don't know what the application really is after that post a screenshot of the line mentionning port 8000 and we'll find out for you.

share|improve this answer
    
TCPView isn’t showing more than netstat (which is why I didn’t even mention that I tried it). But sure, I added a screenshot of the port 8000 lines to my question. –  poke Nov 22 '11 at 17:46

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.