Monitoring port connections in Windows

9:03 AM

You suspect you have a connection problem in Windows. How do you tell if connections are happening? You could install Wireshark but that isn't the most intuitive or easy program to use to see if connections are being made. An alternative is to use CurrPorts from Nir Sofer (32- and 64-bit versions attached to this article.)
While CurrPorts won't help you debug connection problems at the TCP/IP level, it will give you an easy-to-use interface allowing you to see incoming and outgoing connections just above the TCP/IP level. It has a simple filter syntax and logging so you can grab just the data you need and store it for later analysis.
The filter syntax allows you to specify the direction of packet communications, whether to include or exclude those packets, IP address (or a range of addresses), ports (or a range of ports) or even process names. Some examples:
  • include:remote:tcp:80 - this will show only outgoing tcp connections to port 80 (HTTP)
  • include:local:tcp:25 - this will show only incoming tcp connections to port 25 (SMTP)
  • exclude:remote:tcpudp:53 - this will exclude outgoing tcp and udp connections to port 53 (DNS)
  • exclude:both:tcpudp:10.0.0.1 - this excludes all connections, both to and from, 10.0.0.1
CurrPorts is a stand-alone program that requires no installation. Just copy the zip file to a host, unarchive the contents and run the program. A help file is included to explain all the features.
The following screen shot shows CurrPorts in action. The filter used was "include:remote:tcp:80" and shows the new ports opened when Firefox opened www.microsoft.com. New ports (detected since the last refresh) get highlighted in green.

You Might Also Like

0 comments

Contact Form

Name

Email *

Message *

Translate

Wikipedia

Search results