Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 4 down vote favorite

I have executed the following command to get better idea of what is holding the port 8443 on server I'm trying to work on and install some new software on it.

C:\Users\Administrator>netstat -abn | find "8443"
TCP    0.0.0.0:8443           0.0.0.0:0              LISTENING
TCP    [::]:8443              [::]:0                 LISTENING

Any ideas on how to link this to specific service?

the binary without the find is coming up as:

Can not obtain ownership information
share|improve this question

2 Answers

up vote 7 down vote accepted

Drop the pipe to find. Irritatingly, the application is on a new line, so you can't use the find utility.

For example:

C:\Windows\system32>netstat -abn | find "3306"
  TCP    0.0.0.0:3306           0.0.0.0:0              LISTENING
  TCP    [::]:3306              [::]:0                 LISTENING

And without the pipe to find (snipped for brevity)

C:\Windows\system32>netstat -abn
  TCP    0.0.0.0:3306           0.0.0.0:0              LISTENING
 [mysqld.exe]

What you could do is output to a text file (i.e netstat -abn > netstat.txt) and use the search in Notepad to find 8433 and see what executable is listening on the port that way.

If you get Can not obtain ownership information in the output, give it a minute and run the command again. As crazy as that sounds, it happened to me while I was doing the test for this answer. Doing nothing but waiting 30 seconds and running the exact same netstat command again then showed the executable.

share|improve this answer
I get following without the find: Can not obtain ownership information any ideas? – Mat Banik Nov 28 '11 at 2:33
@MatBanik Maybe try it again? Seriously though, I got the Can not obtain ownership information error, and when I ran the exact same command again about 10 seconds later it showed me the process name. – Ben Pilbrow Nov 28 '11 at 18:30
Interesting let me write batch that will output the command every 3 minutes and see what happens. – Mat Banik Nov 28 '11 at 18:42
If that doesn't work, TCPView is a really nifty utility which I forgot all about. See @ckliborn's answer for the link to that. – Ben Pilbrow Nov 28 '11 at 18:46
You were right! It showed [Dropbox.exe] – Mat Banik Nov 28 '11 at 18:48
show 2 more comments
up vote 5 down vote

Check out TCPView

http://technet.microsoft.com/en-us/sysinternals/bb897437

TCPView is a Windows program that will show you detailed listings of all TCP and UDP endpoints on your system, including the local and remote addresses and state of TCP connections. On Windows Server 2008, Vista, and XP, TCPView also reports the name of the process that owns the endpoint. TCPView provides a more informative and conveniently presented subset of the Netstat program that ships with Windows. The TCPView download includes Tcpvcon, a command-line version with the same functionality.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.