Skip to content

Listening Ports

Every program waiting for a network connection is a door. This page is how to see all of them at once, which is what an attacker scanning the machine sees.

List them

netstat -abno
  • -a all connections and listening ports
  • -b the program behind each (needs an administrator prompt)
  • -n numbers instead of names, which is faster
  • -o the process ID
  Proto  Local Address          Foreign Address        State           PID
  TCP    0.0.0.0:135            0.0.0.0:0              LISTENING       912
  RpcSs
 [svchost.exe]
  TCP    0.0.0.0:445            0.0.0.0:0              LISTENING       4
 Can not obtain ownership information
  TCP    0.0.0.0:3389           0.0.0.0:0              LISTENING       1204
  TermService
 [svchost.exe]
  TCP    0.0.0.0:4444           0.0.0.0:0              LISTENING       5820
 [nc.exe]

0.0.0.0 means listening on every network interface. 127.0.0.1 means only from this machine, which is much less exposed.

PowerShell gives a cleaner table:

Get-NetTCPConnection -State Listen | Select LocalAddress, LocalPort, OwningProcess, @{n='Process';e={(Get-Process -Id $_.OwningProcess).Name}} | Sort LocalPort

Port proxies

Windows can forward a port to another address with netsh interface portproxy. Attackers use it to pivot: traffic to this machine's port 8080 silently goes to a machine on an internal network. Nothing on a workstation should have one.

netsh interface portproxy show all

Empty output is correct. Anything listed is a finding (STIG WN11-00-000395); remove with netsh interface portproxy reset.

Ports you'll recognize

Port Service Normal?
135 RPC Yes, always present
139, 445 SMB (file sharing) Yes if the machine shares files or is on a domain
3389 Remote Desktop Only if the README requires RDP
5985, 5986 WinRM (PowerShell remoting) Usually not on a workstation
21 FTP Only on an FTP server
22 SSH Only if the README says so
23 Telnet Never
25, 110, 143, 993, 995 Mail Only on a mail server
53 DNS Only on a DNS server
80, 443 Web Only on a web server
1433 SQL Server Only on a database server
4444, 5555, 31337, and other odd numbers Nothing legitimate Investigate. Often a backdoor.

What to do with each line

For each listening port, answer: what program is this, and does the README give it a reason to be listening?

  • Known Windows service the machine needs: leave it.
  • Known service the machine doesn't need: disable the service (next page).
  • Unknown program: find it. tasklist /fi "pid eq 5820" names the process; Task Manager → Details → right-click → Open file location shows where it lives. A program listening from a user folder or C:\Windows\Temp is malware until proven otherwise. See Malware Persistence.

Example

The listing above shows nc.exe (netcat) listening on 4444. Netcat is a hacking tool; port 4444 is the default for several remote-access payloads. Find the file, kill the process (taskkill /pid 5820 /f), delete the file, then look for whatever starts it at boot.

Next

Services to Disable