I got the following capture in procmon for a java program that made a HTTP GET call to url
on web. It did capture the operations like TCP Receive etc. But I am not sure what does the
Path means here Each line in Path has two ports and the initial port seems to be changing
whereas the second one doesn't. enter image description here

  • What’s your question? What the “Path” column describes? Why the first port is changing?
    – Daniel B
    Apr 7 at 12:19

A TCP connection connects two sockets that can reside in different programs and on different computers connected via a newtwork.

If one participant of this connection sends data to the other participand you have a sender and a receiver.

The column "Path" shows this direction when data is sent:


DESKTOP-NHT8PTC is the DNS name of the used computer, thus it is a local communication. However it is unclear if the communication uses localhost or an external IP address to connect.

49220 and 64660 are the TCP ports used.

Both ports are located within the dynamic ports—Ports (49152 to 65535). Based on your log the conection was initiated from port 49220, which means that port 64660 is the TCP port the server is listening on.

  • They're not within the same process. You're mixing up the Send/Receive events with Connect/Accept. OP's screenshot only shows an outbound connection; the "Send" is the actual HTTP request and the "Receive" is the response.
    – user1686
    Apr 7 at 10:22
  • @user1686 Correct, I deleted that section.
    – Robert
    Apr 7 at 10:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.