The port 9001 seems to be used by Microsoft-HTTPAPI/2.0. I get this from the browser doing a http://localhost:9001/

HTTP/1.1 404 Not Found
Content-Type: text/html; charset=us-ascii
Server: Microsoft-HTTPAPI/2.0
Date: Thu, 09 Apr 2020 08:10:11 GMT
Connection: close
Content-Length: 315

Using netstat -aonb | grep 9001:

  TCP               LISTENING       4
  TCP    [::]:9001              [::]:0                 LISTENING       4
  TCP    [::1]:9001             [::1]:50916            TIME_WAIT       0
  TCP    [::1]:9001             [::1]:50957            TIME_WAIT       0

So PID 4 is ntoskrnl.exe.

I checked that Internet Information Service is off

enter image description here

How could I investigate further ? Thank you for your help


After Daniel B comment I did the following:

$ netsh http show servicestate                                                      

Snapshot of HTTP service state (Server Session View):                               

Server session ID: FF00000520000001                                                 
    Version: 2.0                                                                    
    State: Active                                                                   
        Max bandwidth: 4294967295                                                   
            Entity body timeout (secs): 120                                         
            Drain entity body timeout (secs): 120                                   
            Request queue timeout (secs): 120                                       
            Idle connection timeout (secs): 120                                     
            Header wait timeout (secs): 120                                         
            Minimum send rate (bytes/sec): 150                                      
    URL groups:                                                                     
    URL group ID: FE00000540000001                                                  
        State: Active                                                               
        Request queue name: Request queue is unnamed.                               
            Max bandwidth: inherited                                                
            Max connections: inherited                                              
                Timeout values inherited                                            
            Number of registered URLs: 1                                            
            Registered URLs:                                                        

Request queues:                                                                     
    Request queue name: Request queue is unnamed.                                   
        Version: 2.0                                                                
        State: Active                                                               
        Request queue 503 verbosity level: Basic                                    
        Max requests: 1000                                                          
        Number of active processes attached: 1                                      
        Process IDs:                                                                

And now I get the culprit Process IDs: 5592, IGGC/Service stands for
Intel Graphic Command Center

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.