Something is using port 80 and I can't figure out what [duplicate]

Question

Possible Duplicate:
How to find exe listening on port?
What is using port 80?

I need to setup a local webserver that I made and bind it to 127.0.0.1:80. However, I can't seem to figure out what's using up the port 80 of this laptop. I've got IIS installed but I've already disabled it. Now, however, instead of getting the usual IIS welcome page that I didn't change, when going to 127.0.0.1 on my browser, I get the following:

Even if I go to the site directories I've set up in IIS before, it will still show this error which confirms my belief that I have successfully disabled IIS. I've been searching around and found this SU thread and tried netstat -o. But as you can see below, there is no PID associated with port 80 which baffles me even more.

I also tried using netstat -ab -p tcp -n but it gives off an error. See below image.

So yeah, I'm out of ideas. Can anyone help me figure out what is using port 80? And also, why does it seem like there's a ghost web server running? I already checked Process Explorer and XAMPP isn't running either. In fact, i can't see anything that even resembles a web server on the process list. I can personally identify most of the processes running such as Google's Music Manager, iTunes Helper, etc.

This is on a Windows 7 32-bit setup.

Answer 1

Specific solution to this problem:

Stop SQL Server or any other webservices or related IIS services (i.e. "SQL Server Reporting Services" - See OPs response in comments below) that might be running. Check you running services using 2 or 3 below. Check the comments as well for how we troubleshot this in more detail.

I would also personnaly recommend using a virtual machine running a LAMP platform then running a WAMP type platform on your development box directly.

If You are troubleshooting a similar issue, you can try these steps

Here is not an exact solution, but it might help, respond and I will update as we go:

1. Capture Network Traffic:

   Download wireshark, install and get it up and running. Select your network interface and start capturing traffic. Open your browser and load the local site. Even though its on the local interface, Wireshark should still capture it. If you look look through all the various fields of the actual HTTP response, you might find the name of the application specified in the server or some other clues that can help you identify what server is providing that web page. In the HTTP traffic you might be able to identify the server name see this entry on Wikipedia:List of HTTP headers, especially the "server" field.

   Update: Per Scott Chamberlain's comment below, on Windows capturing from the local host with Wireshark can be a pain (but here's how to do it per his comment). As an alternative see 5 below. Instead, it might be eaiser to work with a proxy tool like Fiddler, Paros Proxy, Burp Proxy, etc which will let you intercept traffic going both ways to read the raw HTTP.

2. Process Monitor

   You tried Process Explorer, but Process Monitor from sysinternals might be a little more helpful in this case. This will show you files read as you perform activity. Something had to be responding.

3. Running Processes

   It sounds like you have already looked at some running processes, but have you checked out all the running services? You can get information on running services using any of the following options

   • On start menu type "services.msc" and explore graphically
   • On the command line type "tasklist /svc"
   • On the command line type "net start"

4. Use a http diagnostic tool: wfetch from Microsoft

   This tool can help you deal with the raw connections and might be a little easier than using wireshark at noted above, but it accomplishes the same goal: find out what information is being returned in the raw HTTP traffic.

5. Using the Developer tools in Chrome Here is a screenshot of what I am talking about below in the comments:

Answer 2

IIS doesn’t listen directly for HTTP requests on modern versions of Windows. Rather the core of HTTP Is done by the driver http.sys. You can list the currently configured addresses/ports/URLs with the command

netsh http show servicestate

If there is nothing configured for the URL /, then http.sys will generate the 404 NOT FOUND response rather than providing any specific application or service.