Many programs are running on the computer at the same time. If a program uses an Internet connection, a specific port is allocated to it. Sometimes the user needs to control which port a particular program is using.
Instructions
Step 1
The need to determine which ports a program is using (or which program is using ports) usually arises when you suspect a Trojan horse has infected your computer. If you notice something suspicious, open Command Prompt: Start - All Programs - Accessories - Command Prompt.
Step 2
Type tasklist at the command line and press Enter. You will receive data on all processes running in the system. Pay attention to the PID - process identifier. It will help you determine which program is using a particular port.
Step 3
Type netstat –aon at a command prompt and press Enter. You will see a list of current connections. The “Local address” column at the end of each line contains the port number. The PID column contains the process identifiers. After looking at the port number and the corresponding PID, go to the list of processes and use the identifier number to determine which process is using this port.
Step 4
If you cannot understand by the name of the process which program it belongs to, use one of the programs that are suitable in this case. For example, the program Everest, aka Aida64. Run the program, open the "Operating System" tab, select "Processes". In the list of processes, find the one you need and see the line for its launch. This will help determine which program the process belongs to.
Step 5
Use AnVir Task Manager for the same purpose. It allows you to track all suspicious processes, including the processes of programs connecting to the Internet. All suspicious processes are highlighted in red in the program list.
Step 6
If you see that the port is being used by an unknown program, then if there is a current connection in the "External address" column (netstat –aon command), you will see the ip-address of the computer with which the connection is established. The column "State" will contain the value ESTABLISHED - if the connection is present at the current moment; CLOSE_WAIT if the connection is closed; LISTENING if the program is waiting for a connection. The latter is typical for backdoors, a type of Trojan horse.
