I know how to display all open ports and to show
the IP and names of who is connected and what
state the ports are in, I even know how to close them
off, but my question is this, is there away to find out
what program owns what port?? because I want to show
the program that owns the port in my port viewer program
so the user will know what program is using a port before
desiding to close the port and app. ect.


zcoder....
Posted on 2002-01-26 15:18:05 by Zcoder
My best guess :)

Look up the WSADuplicateSocket API, it's used to share sockets between apps. It uses the IPC (Interprocess Communication) to hand the info about the socket to the other (your) app. Perhaps it's possible to check who's app is sending you this info? Just a guess, 'cause I don't really know how IPC works :rolleyes:
Posted on 2002-01-27 02:54:04 by Qweerdy
there's a program for NT/2k called Fport by Foundstone that lists open ports (TCP and UDP) and the program that opened the port.

here an output example:

FPort v1.33 - TCP/IP Process to Port Mapper

Copyright 2000 by Foundstone, Inc.
[url]http://www.foundstone.com[/url]

Pid Process Port Proto Path
412 svchost -> 135 TCP C:\WINNT\system32\svchost.exe
8 System -> 139 TCP
8 System -> 445 TCP
548 MSTask -> 1025 TCP C:\WINNT\system32\MSTask.exe
8 System -> 1027 TCP
8 System -> 1031 TCP
1040 WFICA32 -> 1034 TCP C:\PROGRA~1\Citrix\ICACLI~1\WFICA32.EXE
1068 IEXPLORE -> 1173 TCP C:\Program Files\Internet Explorer\IEXPLORE.EXE
8 System -> 137 UDP
8 System -> 138 UDP
8 System -> 445 UDP
244 lsass -> 500 UDP C:\WINNT\system32\lsass.exe
232 services -> 1030 UDP C:\WINNT\system32\services.exe
992 msimn -> 1041 UDP C:\Program Files\Outlook Express\msimn.exe

get it from:
http://www.foundstone.com/knowledge/termsofuse.html?filename=FPortNG.zip

Not sure how exactly the program works, but i think it uses Native Api's to get the job done.
Posted on 2002-01-27 09:17:05 by savage
Looks like they are using the PSAPI.DLL(Process Status API) to get the info. This is similar to ToolHelp32 library. Here is a link to the PSAPI info on msdn:

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/perfmon/psapi_25ki.asp?frame=true
Posted on 2002-01-28 13:46:03 by rdaneel
Thanks for this info, but it seems
to not work on XP, also I am mostly
looking for something that would
work on 98/me/2000,xp ect.


Thanks Zcoder....
Posted on 2002-02-01 04:38:13 by Zcoder