Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've recently set up a home server and spent some time working on the security. One of the tools I've been using nmap which I pointed at my Windows 7 desktop. It showed an unknown service on port 10243. When I connected to the port with netcat it identified itself as Server: Microsoft-HTTPAPI/2.0?

Anyone know what this is or how I can find out? I've tried browsing it in firefox but nothing comes up.

[root@laptop]# nc 192.168.0.4 10243
get

HTTP/1.1 400 Bad Request
Content-Type: text/html; charset=us-ascii
Server: Microsoft-HTTPAPI/2.0
Date: Fri, 25 Jan 2013 19:28:53 GMT
Connection: close
Content-Length: 326

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd">
<HTML><HEAD><TITLE>Bad Request</TITLE>
<META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD>
<BODY><h2>Bad Request - Invalid Verb</h2>
<hr><p>HTTP Error 400. The request verb is invalid.</p>
</BODY></HTML>

[root@laptop]# 
share|improve this question
    
Do a "netstat -b" on the problem machine (or use TCPView from Sysinternals) to see what program is listening on that port. – Brian Jan 25 '13 at 20:41
    
@Brian Thanks. TCPView show Process=System Pid=4 but cant get any process information? – James Jan 26 '13 at 0:21

I had the same issue, but with the port 10,000, which was in conflict with Azure Emulator (it uses port 10,000 - 10,002). I don't know, how does it work exactly, but I'm guessing this:

WinHTTP is a Windows service, which can be used by 3rd party applications to communicate over HTTP. They can create a listening HTTP server on any port they like.

So if you need quick & dirty solution, you can just stop the service WinHTTP WPAD. It's possible, that it will close the listening servers, but it's also possible that 3rd party application will start it again after some time.

If you want some longer term solution, you should find which application is requesting a server on that port and then it depends on that application (you can reconfigure it, or just don't use it).

You can also check my answer on StackOverflow.com.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.