From: "Rich" 

This is a multi-part message in MIME format.

------=_NextPart_000_0516_01C44338.794F5B90
Content-Type: text/plain;
        charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

   There is no way to associate a socket with any specific component =
within a process that opened it.  If RPC you can find the endpoint using =
the tools to which I referred.  Try rpcdump from =
http://www.microsoft.com/windows2000/techinfo/reskit/tools/existing/rpcdu=
mp-o.asp.  I don't know if this version works on Windows XP.

   Port 1025, and for that matter, potentially all ports >=3D 1024, can =
be used for any purpose.  That someone registered one for a specific =
purpose means little.

Rich


  "Gregg N"  wrote in message =
news:40b51016$1{at}w3.nls.net...
  Netstat is in fact what I've been using to see what is open. The =
problem is that the owning process is often svchost, which hosts many =
services. Is there a way to find out which specific service hosted by =
svchost has a port open? Mabye some netsh incantation?

  For example, how do I find out what Windows service listens on port =
1025? This is registered as Internet Blackjack, of all things. So far, I =
have seen this only on XP computers, not 2000 ones. Netstat shows it is =
owned by svchost, but how do I find out which service within svchost?

  Gregg

    "Rich"  wrote in message news:40b4dc20{at}w3.nls.net...
       Those could be randomly allocated RPC ports.  Use NETSTAT -ao to =
see the process that has these opened.  There are other tools that will =
identify RPC endpoints if they are RPC but these are in either developer =
or resource kits.

    Rich

      "Gregg N"  wrote in message =
news:40b4d543$1{at}w3.nls.net...
      Does anyone know where I can find a list of the network TCP and =
UDP ports
      that Windows XP opens either actively or passively (i.e., =
listening) in a
      default LAN installation?

      Also, IANA (http://www.iana.org/assignments/port-numbers) does not =
indicate
      what ports 1147 and 1148 are, but these appear to be active on one =
machine.

      Thanks.

      Gregg


------=_NextPart_000_0516_01C44338.794F5B90
Content-Type: text/html;
        charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable








   There is
no way to =
associate a socket=20
with any specific component within a process that opened it.  If =
RPC you=20
can find the endpoint using the tools to which I referred.  Try = rpcdump=20
from http://www.microsoft.com/windows2000/techinfo/reskit/tools/existi=
ng/rpcdump-o.asp">http://www.microsoft.com/windows2000/techinfo/reskit/to=
ols/existing/rpcdump-o.asp. =20
I don't know if this version works on Windows XP.
 
   Port
1025, and for that =
matter,=20
potentially all ports >=3D 1024, can be used for any
purpose.  = That=20
someone registered one for a specific purpose means little.
 
Rich
 
 

  "Gregg N" <greggn{at}invalid.invalid>">mailto:greggn{at}invalid.invalid">greggn{at}invalid.invalid>
=
wrote in=20
  message news:40b51016$1{at}w3.nls.net...
  Netstat is in fact what I've been =
using to see=20
  what is open. The problem is that the owning process is often svchost, =
which=20
  hosts many services. Is there a way to find out which specific service =
hosted=20
  by svchost has a port open? Mabye some netsh incantation?
   
  For example, how do I find out what =
Windows=20
  service listens on port 1025? This is=20
  registered as Internet Blackjack, of all things. So far, I have seen =
this only=20
  on XP computers, not 2000 ones. Netstat shows it is owned by svchost, =
but how=20
  do I find out which service within svchost?
   
  Gregg
   
  

    "Rich" <{at}> wrote in message news:40b4dc20{at}w3.nls.net...
       Those
could be =
randomly allocated=20
    RPC ports.  Use NETSTAT -ao to see the process that has these=20
    opened.  There are other tools that will identify RPC endpoints =
if they=20
    are RPC but these are in either developer or resource =
kits.
     
    Rich
     
    
      "Gregg N" <greggn{at}invalid.invalid>">mailto:greggn{at}invalid.invalid">greggn{at}invalid.invalid>
= wrote=20
      in message news:40b4d543$1{at}w3.nls.net...Does=20
      anyone know where I can find a list of the network TCP and UDP=20
      portsthat Windows XP opens either actively or passively (i.e., =

      listening) in adefault LAN
installation?Also, IANA (http://www.iana.org" target="new">http://www.iana.org=">http://www.iana.org/assignments/port-numbers">http://www.iana.org=
/assignments/port-numbers)=20
      does not indicatewhat ports 1147 and 1148 are, but these =
appear to be=20
      active on one=20
  =
machine.Thanks.Gregg

------=_NextPart_000_0516_01C44338.794F5B90--

--- BBBS/NT v4.01 Flag-5