Monitoring port connections in Windows
9:03 AM
You suspect you have a connection problem in Windows. How do you tell
if connections are happening? You could install Wireshark but that
isn't the most intuitive or easy program to use to see if connections
are being made. An alternative is to use CurrPorts from Nir Sofer (32- and 64-bit versions attached to this article.)
While CurrPorts won't help you debug connection problems at the TCP/IP level, it will give you an easy-to-use interface allowing you to see incoming and outgoing connections just above the TCP/IP level. It has a simple filter syntax and logging so you can grab just the data you need and store it for later analysis.
The filter syntax allows you to specify the direction of packet communications, whether to include or exclude those packets, IP address (or a range of addresses), ports (or a range of ports) or even process names. Some examples:
The following screen shot shows CurrPorts in action. The filter used was "include:remote:tcp:80" and shows the new ports opened when Firefox opened www.microsoft.com. New ports (detected since the last refresh) get highlighted in green.
While CurrPorts won't help you debug connection problems at the TCP/IP level, it will give you an easy-to-use interface allowing you to see incoming and outgoing connections just above the TCP/IP level. It has a simple filter syntax and logging so you can grab just the data you need and store it for later analysis.
The filter syntax allows you to specify the direction of packet communications, whether to include or exclude those packets, IP address (or a range of addresses), ports (or a range of ports) or even process names. Some examples:
- include:remote:tcp:80 - this will show only outgoing tcp connections to port 80 (HTTP)
- include:local:tcp:25 - this will show only incoming tcp connections to port 25 (SMTP)
- exclude:remote:tcpudp:53 - this will exclude outgoing tcp and udp connections to port 53 (DNS)
- exclude:both:tcpudp:10.0.0.1 - this excludes all connections, both to and from, 10.0.0.1
The following screen shot shows CurrPorts in action. The filter used was "include:remote:tcp:80" and shows the new ports opened when Firefox opened www.microsoft.com. New ports (detected since the last refresh) get highlighted in green.
0 comments