netstat介绍
1.netstat -a 列出所有正在运行程序的端口 如下:
Active Connections
Proto Local Address Foreign Address State
TCP 0.0.0.0:90 0.0.0.0:0 LISTENING
TCP 0.0.0.0:19780 0.0.0.0:0 LISTENING
TCP 127.0.0.1:1052 127.0.0.1:1110 ESTABLISHED
TCP 127.0.0.1:1110 127.0.0.1:1052 ESTABLISHED
2.netstat -ano 列出所有正在运行程序的端口及PID 如下:
Active Connections
Proto Local Address Foreign Address State PID
TCP 0.0.0.0:90 0.0.0.0:0 LISTENING 3468
TCP 0.0.0.0:135 0.0.0.0:0 LISTENING 1120
TCP 127.0.0.1:1052 127.0.0.1:1110 ESTABLISHED 3368
TCP 127.0.0.1:1110 127.0.0.1:1052 ESTABLISHED 1680
TCP 127.0.0.1:8005 0.0.0.0:0 LISTENING 3468
3.netstat -anb 列出所有正在运行程序的端口,PID及使用这个端口的进程( ):
Active Connections
Proto Local Address Foreign Address State PID
TCP 0.0.0.0:90 0.0.0.0:0 LISTENING 3468
[java.exe]
TCP 0.0.0.0:135 0.0.0.0:0 LISTENING 1120
c:windowssystem32WS2_32.dll
C:WINDOWSsystem32RPCRT4.dll
c:windowssystem32 pcss.dll
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32ADVAPI32.dll
[svchost.exe]
TCP 0.0.0.0:445 0.0.0.0:0 LISTENING 4
[System]
TCP 127.0.0.1:1433 127.0.0.1:1143 ESTABLISHED 2880
[sqlservr.exe]
4.netstat -aon|findstr "9050" 查看指定端口的占用情况
协议 本地地址 外部地址 状态 PID
TCP 127.0.0.1:9050 0.0.0.0:0 LISTENING 2016
5.tasklist|findstr "2016" 查看PID对应的进程
映像名称 PID 会话名 会话 内存使用
tor.exe 2016 Console 0 16,064 K
6.taskkill /f /t /im tor.exe 结束该进程
Fport介绍
fport supports Windows NT4, Windows 2000 and Windows XP
fport reports all open TCP/IP and UDP ports and maps them to the owning application.
This is the same information you would see using the 'netstat -an' command, but it also
maps those ports to running processes with the PID, process name and path. Fport can be
used to quickly identify unknown open ports and their associated applications.
Usage:
C:>fport
FPort v2.0 - TCP/IP Process to Port Mapper
Copyright 2000 by Foundstone, Inc.
http://www.foundstone.com
Pid Process Port Proto Path
392 svchost -> 135 TCP C:WINNTsystem32svchost.exe
8 System -> 139 TCP
8 System -> 445 TCP
508 MSTask -> 1025 TCP C:WINNTsystem32MSTask.exe
392 svchost -> 135 UDP C:WINNTsystem32svchost.exe
8 System -> 137 UDP
8 System -> 138 UDP
8 System -> 445 UDP
224 lsass -> 500 UDP C:WINNTsystem32lsass.exe
212 services -> 1026 UDP C:WINNTsystem32services.exe
The program contains five (5) switches. The switches may be utilized using either a '/'
or a '-' preceding the switch. The switches are:
Usage:
/? usage help
/p sort by port
/a sort by application
/i sort by pid
/ap sort by application path
For updates visit: www.foundstone.com