From: "Rich" 

This is a multi-part message in MIME format.

------=_NextPart_000_0567_01C44433.5F344B20
Content-Type: text/plain;
        charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

   You appear to have still not tried the Microsoft tool to which I =
referred you.

   As for being documented, dynamically assigned ports would not be =
documented by port number as the allocation is just that, dynamic.  The =
ranges used, if this is RPC, is well documented.

Rich

  "Gregg N"  wrote in message =
news:Xns94F6F33A11B7Dgregginvalidinvalid{at}216.144.1.254...
  "Geo."  wrote in news:40b698f4{at}w3.nls.net:

  > "Gregg N"  wrote in message
  > news:40b612a1{at}w3.nls.net...=20
  >> I tried stopping Task Scheduler from the services control panel, =
but
  >> port 1025 remained in listening state. I can telnet into this port
  >> successfully, but nothing is generated or echoed when I do.
  >=20
  > Yes and I don't know why windows does that but I've seen it before.
  > For example I had the MS news server installed on a machine at one
  > time, then we moved to dnews so stopped the news service and
  > uninstalled it as best I could but port 119 remains open if I port
  > scan the machine. As best I can tell there is nothing listening on
  > that port but it still tests as open for some reason. I'm assuming
  > your experience with task manager is similar.=20
  >=20
  > Geo.

  Tcpview (and netstat) says the process listening on 1025 is the =
instance=20
  of svchost with pid 656. So I did a taskview /svc to find out what=20
  services are running inside that instance of svchost. Here is what I =
got:

  svchost.exe 656 AudioSrv, BITS, CryptSvc, Dhcp, dmserver,
                  ERSvc, EventSystem,
                  FastUserSwitchingCompatibility, helpsvc,
                  lanmanserver, lanmanworkstation, Netman,
                  Nla, RasMan, Schedule, seclogon, SENS,
                  SharedAccess, ShellHWDetection, srservice,
                  TapiSrv, TermService, Themes, TrkWks,
                  uploadmgr, W32Time, winmgmt, wuauserv, WZCSVC

  As you can see, "schedule" is in fact one of the services running =
inside=20
  this instance of svchost. But there are also two dozen others.

  It seems crazy that I should have to play detective to determine what=20
  ports are listened on by which Windows services. Isn't any of this=20
  documented?

  Gregg
------=_NextPart_000_0567_01C44433.5F344B20
Content-Type: text/html;
        charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable








   You
appear to have still =
not tried the=20
Microsoft tool to which I referred you.
 
   As for
being documented, =
dynamically=20
assigned ports would not be documented by port number as the allocation = is just=20
that, dynamic.  The ranges used, if this is RPC, is well=20
documented.
 
Rich
 

  "Gregg N" <gregg{at}invalid.invalid>">mailto:gregg{at}invalid.invalid">gregg{at}invalid.invalid>
=
wrote in=20
  message news:Xns9=
4F6F33A11B7Dgregginvalidinvalid{at}216.144.1.254..."Geo."=20
  <georger{at}nls.net>">mailto:georger{at}nls.net">georger{at}nls.net>
wrote =
in news:40b698f4{at}w3.nls.net:&g=
t;=20
  "Gregg N" <greggn{at}invalid.invalid>">mailto:greggn{at}invalid.invalid">greggn{at}invalid.invalid>
=
wrote in=20
  message> news:40b612a1{at}w3.nls.net...
=
>> I=20
  tried stopping Task Scheduler from the services control panel, =
but>>=20
  port 1025 remained in listening state. I can telnet into this =
port>>=20
  successfully, but nothing is generated or echoed when I do.> =
>=20
  Yes and I don't know why windows does that but I've seen it =
before.>=20
  For example I had the MS news server installed on a machine at =
one>=20
  time, then we moved to dnews so stopped the news service and>=20
  uninstalled it as best I could but port 119 remains open if I =
port>=20
  scan the machine. As best I can tell there is nothing listening =
on>=20
  that port but it still tests as open for some reason. I'm =
assuming>=20
  your experience with task manager is similar. >
>=20
  Geo.Tcpview (and netstat) says the process listening on 1025 =
is the=20
  instance of svchost with pid 656. So I did a taskview /svc to find =
out=20
  what services are running inside that instance of svchost. Here is =
what I=20
  got:svchost.exe 656 AudioSrv, BITS, CryptSvc, Dhcp,=20
  =
dmserver,          =
     =20
  ERSvc,=20
  =
EventSystem,         &nb=
sp;     =20
  FastUserSwitchingCompatibility,=20
  =
helpsvc,          &=
nbsp;    =20
  lanmanserver, lanmanworkstation,=20
  =
Netman,          &n=
bsp;    =20
  Nla, RasMan, Schedule, seclogon,=20
  =
SENS,          &nbs=
p;    =20
  SharedAccess, ShellHWDetection,=20
  =
srservice,          =
;     =20
  TapiSrv, TermService, Themes,=20
  =
TrkWks,          &n=
bsp;    =20
  uploadmgr, W32Time, winmgmt, wuauserv, WZCSVCAs you can see,=20
  "schedule" is in fact one of the services running inside this =
instance of=20
  svchost. But there are also two dozen others.It seems crazy =
that I=20
  should have to play detective to determine what ports are listened =
on by=20
  which Windows services. Isn't any of this=20
documented?Gregg

------=_NextPart_000_0567_01C44433.5F344B20--

--- BBBS/NT v4.01 Flag-5