The operating system allocates a local port to each program working with the network, through which it makes the connection. Sometimes a user needs to find out on which port a particular program is running or which application is occupying a particular port.
Instructions
Step 1
Information on the ports used may be useful if you suspect that your computer has been infected with Trojans. In particular, it may be indicated by such signs as increased traffic or network activity of the computer at a time when you are not using the Internet.
Step 2
If you suspect a computer infection, first of all check which local ports are open on it. To do this, open the command line: "Start" - "All programs" - "Accessories" - "Command line". Enter the command netstat - aon in the terminal window that opens, it will show all current connections.
Step 3
In the first column of the list that appears, the type of connection is indicated. In the second, the local address and ports used. The column "External address" will show the addresses to which your computer connects. In the "Status" column you can see the status of the connection - whether it exists at the moment - ESTABLISHED, completed - TIME_WITE or the program is listening on the port, that is, ready for communication - LISTENING. Finally, the PID column shows the process ID - a numeric code with which you can easily understand which process is "hanging" on a particular port.
Step 4
Type the tasklist command in the same window, you will see a list of running processes. In the second column, right after the names of the processes, their identifiers are indicated. Let's say you see from the first list that you have a local port 3564 open. Then look in the last column (PID) and find the process ID - for example, 3388 (your data will be different). Now go to the second table, look in the second column for PID 3388 and to the left of it you see the name of the program that opened this port.
Step 5
In order to get more information about the addresses to which your computer connects, use the appropriate network services. For example, this: https://www.ip-ping.ru/whois/ Enter the required ip-address in the field, click the "Request" button and you will receive all the available data.
