From: "Geo." 

1025 is probably the scheduler service

Geo.

"Rich"  wrote in message news:40b51d0f{at}w3.nls.net...
   There is no way to associate a socket with any specific component within a
process that opened it.  If RPC you can find the endpoint using the tools
to which I referred.  Try rpcdump from
http://www.microsoft.com/windows2000/techinfo/reskit/tools/existing/rpcdump-o.a
sp.
I don't know if this version works on Windows XP.

   Port 1025, and for that matter, potentially all ports >= 1024, can be used
for any purpose.  That someone registered one for a specific purpose means little.

Rich


  "Gregg N"  wrote in message
news:40b51016$1{at}w3.nls.net...
  Netstat is in fact what I've been using to see what is open. The problem is
that the owning process is often svchost, which hosts many services. Is
there a way to find out which specific service hosted by svchost has a port
open? Mabye some netsh incantation?

  For example, how do I find out what Windows service listens on port 1025?
This is registered as Internet Blackjack, of all things. So far, I have
seen this only on XP computers, not 2000 ones. Netstat shows it is owned by
svchost, but how do I find out which service within svchost?

  Gregg

    "Rich"  wrote in message news:40b4dc20{at}w3.nls.net...
       Those could be randomly allocated RPC ports.  Use NETSTAT -ao to see the
process that has these opened.  There are other tools that will identify
RPC endpoints if they are RPC but these are in either developer or resource
kits.

    Rich

      "Gregg N"  wrote in message
news:40b4d543$1{at}w3.nls.net...
      Does anyone know where I can find a list of the network TCP and UDP ports
      that Windows XP opens either actively or passively (i.e., listening) in a
      default LAN installation?

      Also, IANA (http://www.iana.org/assignments/port-numbers) does not
indicate
      what ports 1147 and 1148 are, but these appear to be active on one
machine.

      Thanks.

      Gregg

--- BBBS/NT v4.01 Flag-5