13

I noticed by accident today that I have some unknown webserver listening on port 8000. Opening http://localhost:8000 just returns 404, so I don’t get any hint what exactly is listening there.

I’ve used netstat -ano to find out, that the process with PID 4 is listening on that port. PID 4 is the System process. Why is my system listening on that port, without me actually starting a server? Or how can I find out what exactly is listening there?

I’ve read the related questions about port 80 and port 443, but none of the services mentioned there were running on my system. And the other suggestions there didn’t work either.

edit:

The HTTP response of the server lists Microsoft-HTTPAPI/2.0 as the server.

edit2:

As requested by Shadok, here are the entries of TCPView with 8000 as the port. But I doubt it’s useful at all…

TCPView results

17

IIRC, any program that uses the HTTP Server API to run an HTTP server on Windows will have that service charged to the System process because it's running through the kernel's http.sys server.

You can see the registered URLs by running the following command: netsh http show servicestate. This will include the port number as well.

netstat -ab can also reveal which services started listening on a given port.

  • Thank you! I really should have thought of that myself… I figured out that it was VAIO Care (a Sony utility) who started the service (VCAgent.exe). But apparently that service is not really needed. I kept a network sniffer open to check if there are any requests to the server when clicking around in the program, but nothing really happened (the normal request in the webbrowser did appear). Anyway, I removed it from autostart, so this should be resolved now. Although it’s quite stupid that all the server API always uses the System process. – poke Nov 22 '11 at 18:25
  • +1 for netstat -ab – Kevin Kibler Dec 4 '13 at 15:26
  • Too bad my netstat -ab says "Can not obtain ownership information", so I'm stuck, but otherwise still a useful command – Tominator Jul 4 '14 at 7:39
  • 1
    For reference, my case is Free Video Maker used the port. I encountered Angular JS tutorial server conflict so I have to sort it out. – simongcc Mar 31 '15 at 15:23
  • 1
    (In case this gets lost I've added an answer too.) Also try: netsh http show servicestate view=requestq – Nick Westgate Sep 4 '18 at 23:52
4

A little late maybe but this thread came up quite high on my google search, and seemed most relevent though lacking that final piece of information i found useful.

You can see the (dynamically)registered url's by running the following command: netsh http show servicestate

1

A bit of googling shows WCF example applications using 8000, and the Intel Remote Desktop Interface. I wouldn't expect these to be running as system.

There are a few trojans / backdoors that use 8000, so perhaps booting an Antivirus disk and doing a full scan would be a good idea.

1

You could use TCPView to find out a lot more infos on that process than what you can find through netstat.
If you still don't know what the application really is after that post a screenshot of the line mentionning port 8000 and we'll find out for you.

  • TCPView isn’t showing more than netstat (which is why I didn’t even mention that I tried it). But sure, I added a screenshot of the port 8000 lines to my question. – poke Nov 22 '11 at 17:46
1

System (PID 4) sockets might be http.sys, in which case you can use netsh command given by PiBa-NL.

But note there are a few parameters. It seems the defaults are equivalent to:

netsh http show servicestate view=session verbose=yes

The sessions view didn't help in my case, but this showed the PID:

netsh http show servicestate view=requestq
  • Thanks! The PID was the key for me. – duct_tape_coder Oct 23 '19 at 21:23
0

In my case, port 8000 was taken over by drivers for Sound BlasterX AE-5 sound card. Process Creative.AudPosService located in C:\Program Files (x86)\Creative\Connection Service has been using this port.

Luckily, it is possible to change this port. Open Creative.AudPosService.exe.config and change line where port number is located <add baseAddress="http://localhost:8000/"/> to <add baseAddress="http://localhost:9999/"/> or anything else that don't interfere with your work. Restart computer and it should be fine.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.