I've encountered some strange behavior I don't understand. I'm installing software on a Windows 2003 Server. This software needs to bind to a specific UDP port an all TCP addresses in order to listen to requests. I seem to be able to bind to several ports of my choice but not others; specifically I can't bind to the one port I need, which is 5001. Other presumedly free ports like 5002, 5010 also fail. My first guess was "it's in use by another program", but it doesn't show either in netstat or TCPView (from sysinternals), so I'm at a loss about what to do about this. The program is getting socket error 10048 (address already in use).

These are example commands I use to try and find the "offending" program:

c:\>netstat -a -v -n -o -p udp

Active Connections

  Proto  Local Address          Foreign Address        State           PID
  UDP            *:*                                    4
  UDP            *:*                                    512
  UDP           *:*                                    1980
  UDP           *:*                                    512
  UDP           *:*                                    5920
  UDP           *:*                                    5288
  UDP          *:*                                    856
  UDP         *:*                                    4376
  UDP        *:*                                    856
  UDP        *:*                                    4
  UDP        *:*                                    4

(No UDP port 5001 is in use!)


C:\> netstat -an | findstr 5001

(no output)

I run all tests using the local Administrator account to no avail. My program is written in C++ (Winsock 2), although I also performed quick tests with a simple VB6 program with the same results. There is no DNS service installed (which is known to reserve ranges of UDP ports).

How can I find the "offending" program, i.e., the program taking the UDP port I need to use?

  • in your netstat output, is port 5500 reserved by your app? – Dusan Bajic Jan 29 '14 at 16:19
  • 5500 is a port I'm using temporarily while I find out why I can't use 5001. UDP port 5000 is used by another app of mine. – Guillermo Prandi Jan 29 '14 at 17:05
  • Have you tried WireShark to see if any program is moving data on that port? – Copy Run Start Jan 29 '14 at 17:06
  • I haven't seen any traffic on those ports, no. The bottom question remains: how come the port is "taken" but netstat knows nothing about it? Weird! – Guillermo Prandi Jan 29 '14 at 17:38

Ports 5000 and 5001 are used by Yahoo Messenger. Don't know if both show when you netstat.

Also, 5001 is suspicious - I remember it was used by remote-access trojans. Sorry I have no details.

Have you tried to telnet to your server to port 5001? Is it really listening/in use?

  • 5
    He's talking about a UDP port. You don't "telnet to" a UDP port. – Evan Anderson Feb 1 '14 at 0:46
  • The ports were no longer in use after I rebooted the server. However, I'd still like to know why netstat didn't see the port as in use wilst the program kept getting an "address already in use" error? – Guillermo Prandi Feb 2 '14 at 23:31
  • I'd spitball an application glitch – Michael Bailey Jul 29 '15 at 5:10
  • The only major Trojan who's touched 5001 and has been majorly reported on as doing such is "Sockets de Troie", (I've literally never heard of it) you been to France recently? Also, Yahoo Messenger Chat doesn't use 5001 UDP, but Yahoo Voice does. And A LOT of other miscellaneous applications. – Michael Bailey Jul 29 '15 at 5:12

This looks like an OS error to me. It is very, very old, so who knows? In the short term, reboot. In the long term, consider upgrading to a supported OS; support for server 2003 ended 14 July 2015.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.