I was reading the forum post on General Security and came across a post which explained how to run a report on Windows Services running and their associated ports. http://goo.gl/7fIfnu
I ran “netstat -an -p tcp -b >ports.txt” in the command line in Elevated Command Prompt and the result (see below) seems a bit odd and/or confusing.
Is there anything completely off kilter here?
Thanks in advance.
Report:
[i]Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Windows\system32>netstat -an -p tcp -b
Active Connections
Proto Local Address Foreign Address State
TCP 0.0.0.0:7 0.0.0.0:0 LISTENING
[tcpsvcs.exe]
TCP 0.0.0.0:9 0.0.0.0:0 LISTENING
[tcpsvcs.exe]
TCP 0.0.0.0:13 0.0.0.0:0 LISTENING
[tcpsvcs.exe]
TCP 0.0.0.0:17 0.0.0.0:0 LISTENING
[tcpsvcs.exe]
TCP 0.0.0.0:19 0.0.0.0:0 LISTENING
[tcpsvcs.exe]
TCP 0.0.0.0:135 0.0.0.0:0 LISTENING
RpcSs
[svchost.exe]
TCP 0.0.0.0:445 0.0.0.0:0 LISTENING
Can not obtain ownership information
TCP 0.0.0.0:2869 0.0.0.0:0 LISTENING
Can not obtain ownership information
TCP 0.0.0.0:3389 0.0.0.0:0 LISTENING
CryptSvc
[svchost.exe]
TCP 0.0.0.0:3689 0.0.0.0:0 LISTENING
[iTunes.exe]
TCP 0.0.0.0:5357 0.0.0.0:0 LISTENING
Can not obtain ownership information
TCP 0.0.0.0:5800 0.0.0.0:0 LISTENING
[GeekBuddyRSP.exe]
TCP 0.0.0.0:49152 0.0.0.0:0 LISTENING
[wininit.exe]
TCP 0.0.0.0:49153 0.0.0.0:0 LISTENING
eventlog
[svchost.exe]
TCP 0.0.0.0:49154 0.0.0.0:0 LISTENING
Schedule
[svchost.exe]
TCP 0.0.0.0:49156 0.0.0.0:0 LISTENING
PolicyAgent
[svchost.exe]
TCP 0.0.0.0:49158 0.0.0.0:0 LISTENING
[lsass.exe]
TCP 0.0.0.0:49169 0.0.0.0:0 LISTENING
[services.exe]
TCP 10.0.0.11:139 0.0.0.0:0 LISTENING
Can not obtain ownership information
TCP 10.0.0.11:2869 10.0.0.1:35435 ESTABLISHED
Can not obtain ownership information
TCP 10.0.0.11:3689 10.0.0.10:49950 ESTABLISHED
[iTunes.exe]
TCP 10.0.0.11:3689 10.0.0.10:49957 ESTABLISHED
[iTunes.exe]
TCP 10.0.0.11:3689 10.0.0.10:49958 ESTABLISHED
[iTunes.exe]
TCP 10.0.0.11:3689 10.0.0.10:49960 ESTABLISHED
[iTunes.exe]
TCP 10.0.0.11:3689 10.0.0.10:49961 ESTABLISHED
[iTunes.exe]
TCP 10.0.0.11:51733 17.172.192.33:443 CLOSE_WAIT
[ApplePhotoStreams.exe]
TCP 10.0.0.11:51734 17.172.192.33:443 CLOSE_WAIT
[ApplePhotoStreams.exe]
TCP 10.0.0.11:51737 17.172.192.33:443 CLOSE_WAIT
[ApplePhotoStreams.exe]
TCP 10.0.0.11:51741 17.172.192.33:443 CLOSE_WAIT
[ApplePhotoStreams.exe]
TCP 10.0.0.11:51746 17.172.100.79:443 CLOSE_WAIT
[ApplePhotoStreams.exe]
TCP 10.0.0.11:51747 17.172.100.93:443 CLOSE_WAIT
[ApplePhotoStreams.exe]
TCP 10.0.0.11:51895 17.164.0.48:443 CLOSE_WAIT
[ApplePhotoStreams.exe]
TCP 10.0.0.11:51899 17.164.0.48:443 CLOSE_WAIT
[ApplePhotoStreams.exe]
TCP 10.0.0.11:51901 17.164.0.48:443 CLOSE_WAIT
[ApplePhotoStreams.exe]
TCP 10.0.0.11:56721 207.46.101.8:443 ESTABLISHED
[OUTLOOK.EXE]
TCP 10.0.0.11:56739 17.172.34.30:993 ESTABLISHED
[OUTLOOK.EXE]
TCP 10.0.0.11:56761 17.172.232.106:5223 ESTABLISHED
[APSDaemon.exe]
TCP 10.0.0.11:56762 17.149.32.71:5223 ESTABLISHED
[APSDaemon.exe]
TCP 10.0.0.11:57462 204.79.197.200:80 TIME_WAIT
TCP 10.0.0.11:57465 204.79.197.200:80 TIME_WAIT
TCP 10.0.0.11:57467 204.245.63.41:80 TIME_WAIT
TCP 10.0.0.11:57470 204.79.197.200:443 TIME_WAIT
TCP 10.0.0.11:57485 10.0.0.1:5000 TIME_WAIT
TCP 10.0.0.11:57486 10.0.0.1:5000 TIME_WAIT
TCP 10.0.0.11:57487 10.0.0.1:5000 TIME_WAIT
TCP 10.0.0.11:57488 207.46.101.8:443 ESTABLISHED
[OUTLOOK.EXE]
TCP 10.0.0.11:57489 65.52.103.95:80 ESTABLISHED
[OUTLOOK.EXE]
TCP 10.0.0.11:57490 17.172.34.30:993 ESTABLISHED
[OUTLOOK.EXE]
TCP 10.0.0.11:57491 10.0.0.1:5000 TIME_WAIT
TCP 10.0.0.11:57492 10.0.0.1:5000 TIME_WAIT
TCP 10.0.0.11:57493 10.0.0.1:5000 TIME_WAIT
TCP 10.0.0.11:57494 10.0.0.1:5000 TIME_WAIT
TCP 10.0.0.11:57495 10.0.0.1:5000 TIME_WAIT
TCP 10.0.0.11:57496 10.0.0.1:5000 TIME_WAIT
TCP 127.0.0.1:5354 0.0.0.0:0 LISTENING
[mDNSResponder.exe]
TCP 127.0.0.1:5354 127.0.0.1:65486 ESTABLISHED
[mDNSResponder.exe]
TCP 127.0.0.1:5354 127.0.0.1:65490 ESTABLISHED
[mDNSResponder.exe]
TCP 127.0.0.1:5354 127.0.0.1:65491 ESTABLISHED
[mDNSResponder.exe]
TCP 127.0.0.1:5354 127.0.0.1:65495 ESTABLISHED
[mDNSResponder.exe]
TCP 127.0.0.1:5354 127.0.0.1:65496 ESTABLISHED
[mDNSResponder.exe]
TCP 127.0.0.1:5354 127.0.0.1:65497 ESTABLISHED
[mDNSResponder.exe]
TCP 127.0.0.1:5901 0.0.0.0:0 LISTENING
[GeekBuddyRSP.exe]
TCP 127.0.0.1:27015 0.0.0.0:0 LISTENING
[AppleMobileDeviceService.exe]
TCP 127.0.0.1:27015 127.0.0.1:65484 ESTABLISHED
[AppleMobileDeviceService.exe]
TCP 127.0.0.1:27015 127.0.0.1:65507 ESTABLISHED
[AppleMobileDeviceService.exe]
TCP 127.0.0.1:57513 127.0.0.1:57514 ESTABLISHED
[icedragon.exe]
TCP 127.0.0.1:57514 127.0.0.1:57513 ESTABLISHED
[icedragon.exe]
TCP 127.0.0.1:65484 127.0.0.1:27015 ESTABLISHED
[iTunes.exe]
TCP 127.0.0.1:65486 127.0.0.1:5354 ESTABLISHED
[iTunes.exe]
TCP 127.0.0.1:65490 127.0.0.1:5354 ESTABLISHED
[iTunes.exe]
TCP 127.0.0.1:65491 127.0.0.1:5354 ESTABLISHED
[iTunes.exe]
TCP 127.0.0.1:65495 127.0.0.1:5354 ESTABLISHED
[iTunes.exe]
TCP 127.0.0.1:65496 127.0.0.1:5354 ESTABLISHED
[iTunes.exe]
TCP 127.0.0.1:65497 127.0.0.1:5354 ESTABLISHED
[iTunes.exe]
TCP 127.0.0.1:65507 127.0.0.1:27015 ESTABLISHED
[iTunes.exe]
C:\Windows\system32>[/i]
My System Information - report
OS Name Microsoft Windows 7 Professional
Version 6.1.7601 Service Pack 1 Build 7601
Other OS Description Not Available
OS Manufacturer Microsoft Corporation
System Name DELLSYS7PRO
System Manufacturer Dell Inc.
System Model Inspiron 660
System Type x64-based PC
Processor Intel(R) Pentium(R) CPU G2020 @ 2.90GHz, 2900 Mhz, 2 Core(s), 2 Logical Processor(s)
BIOS Version/Date Dell Inc. A09, 2/1/2013
SMBIOS Version 2.7
Windows Directory C:\Windows
System Directory C:\Windows\system32
Boot Device \Device\HarddiskVolume2
Locale United States
Hardware Abstraction Layer Version = “6.1.7601.17514”
User Name DELLSYS7PRO\Brian
Time Zone Eastern Standard Time
Installed Physical Memory (RAM) 4.00 GB
Total Physical Memory 3.87 GB
Available Physical Memory 1.70 GB
Total Virtual Memory 9.73 GB
Available Virtual Memory 5.43 GB
Page File Space 5.86 GB
Page File C:\pagefile.sys