Well, let's make it an answer.
What you're seeing is most likely the result of a program using http.sys
the Windows Kernel Mode HTTP Engine introduced in Windows Server 2003 (and XP?). It allows developers to circumvent the limitation that a listening port can only be served by one program at a time. With http.sys
, a program registers a namespace, e.g. http://192.168.1.2:80/abc
. The program now receives all requests beginning with the registered namespace. At the same time, another program could listen at http://192.168.1.2:80/xyz
.
Another side-effect is that even "non-root" programs can listen on port 80, provided that a one-time setup has been completed.
Naturally, Microsoft didn't develop this because it's all fun and games. Internet Information Services (IIS) uses http.sys
for listening. So this is a likely candidate in your case.
If no program has currently registered namespaces, http.sys
stops listening.
netsh http show servicestate
should be able to enumerate all active namespaces.
http.sys
is used, you probably have no chance to find out.http.sys
? It is a part of IIS?http.sys
is the Windows Kernel Mode HTTP Engine. It can be used by many programs at the same time, with each listening for requests to a "subdirectory". For .NET, there's the HttpListener class. IIS also useshttp.sys
.