3

My software application runs on port 5700. In the past few days with the recent Windows updates, some of my users' software has stopped working due to this port now being in use by the System process (PID: 4).

I am not sure how to determine which program is using this port? Either it's being used by Windows itself (which would be odd, for the System process to just start using a new port), or some other program is using the System process as some sort of proxy.

For example, I've seen that when I listen to some ports for HTTP requests in my app, then the PID that is shown using that port number is 4 (System process). This is more or less confirmed here: https://github.com/dotnet/corefx/issues/428

I have tried running the command netsh http show urlacl to see all of the HTTP port reservations, but my port doesn't show up in this list. So it doesn't appear to be reserved, but it's in use.

The exception in question when we try listening on that port is:

A TCP error (10013: An attempt was made to access a socket in a way forbidden by its access permissions) occurred while listening on IP Endpoint=0.0.0.0:5700.

Improve this question

2 Answers 2

Reset to default
2

Procexplorer, netstat, tasklist, etc... tend to be shy on details as System obfuscates underlying info.

You could try net stop http to deload HTTP.sys. it should warn you what services have a dependency on it. Use that output to go through a process of elimination... hopefully you find the culprit.

As a side note, I know Dell SupportAssist uses port 5700, but that shouldn't run as System.

Improve this answer
4
  • 1
    FYI: I just looked at one of my home laptops and Dell Support Assist does in fact run as System.
    – joeqwerty
    Jul 11, 2017 at 2:58
  • 1
    Interesting, mine is wrapped in its own daemon for the service. All of my instances are new though, so maybe a version difference? Good to know though
    – Ulfy
    Jul 11, 2017 at 3:13
  • My bad, I just looked again after updating SupportAssist and it's running under the user context of the logged in user that launches it. Apologies.
    – joeqwerty
    Jul 11, 2017 at 11:18
  • Bingo, it was Dell Support Assist.
    – Trevor Elliott
    Jul 12, 2017 at 19:17
1

I would try running tcpview from SysInternals, it has always helped in scenarios like this.

Improve this answer
2
  • I used TCPView, it doesn't really give any more information other than the fact that the System process is listening on port 5700. Is there something specific you had in mind?
    – Trevor Elliott
    Jul 11, 2017 at 17:22
  • Have you tried changing startups to minimal set, then adding things back in?
    – SqlACID
    Jul 11, 2017 at 19:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.