From: "Geo." 

When I run it, I can see svchost and under that and indented I can see
what's wrapped (is that the right description?) by svchost by
doubleclicking the svchost line in tcpview.

Geo.

"Gregg"  wrote in message
news:Xns94F6ED3F15BEDgregginvalidinvalid{at}216.144.1.254...
> "Geo."  wrote in news:40b69839$1{at}w3.nls.net:
>
> > tcpview can tell you what process is inside svchost when it's holding
> > a port open.
> >
>
> What do you mean by process inside svchost? Svchost doesn't have processes,
> svchost *is* a process, and is what tcpview shows. A single process can
> host multiple services, each in its own thread.
>
> Gregg

--- BBBS/NT v4.01 Flag-5