Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

If I want to find out what process is listening on what socket, I can use netstat/TCPview and will immediately see it. However, it is possible to bind to an address without listening. If this is done, it does not show up in netstat/TCPview, but does block the socket.

Python example:

import socket
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.bind(('0.0.0.0',12345))

The port is now bound, and attempting to execute the same code in a second instance while the first is still running will result in an error. However, unless you actually start listening on that port using

s.listen(1)

the port does not show up in netstat/TCPview.

The question is: Is it possible to see what ports are bound (but not listening), and which process is binding them?

The background of this is that I have had a moving range of 1976 ports that cannot be bound, and I want to know what causes this. In the meantime, I determined through trial and error that Internet Connection Sharing was blocking those ports, but I am still curious about the answer to this question.

Edit: Due to popular request, here is the code I used to find those ports:

import time
import socket

for i in range(0,65536):
    try:
        print "Listening on port", i, '...', 
        serversocket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        serversocket.bind(('0.0.0.0', i))
        serversocket.listen(5)
        #time.sleep(0.1)
        serversocket.close()
        print "ok"
    except:
        print "FAIL"

(you may want to pipe the output to grep and filter for FAIL only)

share|improve this question
    
You can loop this script from 0 to 65535, log the ports it fails on and compare the result with netstat ports. The ones not listed in netstat should be what you are looking for. I don't know of any tool or technique that will show you what process is behind those ports, unless it is listening. –  kedar Mar 15 '13 at 9:15
    
@Kedar: That is exactly what I did to find out which ports are affected. –  Jan Schejbal Mar 15 '13 at 14:53
    
@Lizz: Code posted. –  Jan Schejbal Mar 21 '13 at 11:50
    
could you post it as the answer? would be good to have as reference :) –  Lizz Mar 21 '13 at 15:35
    
@Lizz: It is not an answer to the question. It shows which ports are affected, but not what is occupying them. –  Jan Schejbal Mar 21 '13 at 23:32

1 Answer 1

you should use

DWORD GetExtendedTcpTable (PVOID pTcpTable,PDWORD pdwSize, BOOL bOrder, ULONG ulAf, TCP_TABLE_CLASS TableClass,ULONG Reserved );

with

TableClass value = TCP_TABLE_OWNER_PID_ALL "or" TCP_TABLE_OWNER_PID_CONNECTIONS "or" TCP_TABLE_OWNER_PID_LISTENER

pTcpTable structure -> MIB_TCPTABLE_OWNER_PID

depending on the info you'd like to retrieve

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.