2

How can I see for specific time period, which app had bound some specific port in Windows? I am auto-starting my app with windows and I am bounding port 1200 as UDP packet receiver, but sometimes my app reports that the port is taken. Can I see which app did that in the Windows Event Viewer or somewhere else? So, I can`t use netstat to see which app is currently using it, I need historic data.

Saša Šijak
  • 123
  • 1
  • 5
  • Are you sure the application which you refer to has completely exited? if using a threaded model you still may have a background thread holding that port open thus blocking other binding requests. – Wayne Jun 02 '14 at 08:54
  • @Wayne My app can not bind the port 1200 at boot (app is in startup folder) in about 1/5 of the boot cases. And after PC is booted and app failed to bind the port, I can start it manually (which means that the port was released). I tried to put the loop in my app to try every 1s to bind the port and log that, and I see that sometimes my app needs 10, sometimes 120, sometimes 200s to be able to bind the port. How to see who was taking this port. – Saša Šijak Jun 02 '14 at 08:59

1 Answers1

0

I don't think you can get the historic data and somebody may post some information on this.

You could change the way you start your application by wrapping it in say a .bat/.cmd file.

You could then use some tools from the Systernals Suite.

An example bat file:

@echo off
REM Log TCP/UDP port information before starting
REM UNREM the best command for your environment
REM Systernals
tcpvcon.exe -a -n -c > X:\Drive\File.csv
REM Native
REM netstat -t -a | find "LISTENING" > X:\Drive\File.csv
myapplication.exe

This would write a CSV file with all the listening and connected sockets that you could then try to identify where the problem lies.

I also included the netstat version if you need standard native windows version that only shows ports in a listening mode.

Update

You can also use the windows firewall in vista and higher to log information. See TechNet for more information.

  1. Start Control Panel
  2. Open Windows Firewall
  3. Open Advanced Settings
  4. In Actions Select Properties
  5. Click Customise in logging
  6. Choose to enable logging dropped/connected packets
  7. Click ok to enable/disable

Or via netsh: netsh firewall set logging droppedpackets=enable connection=enable

Wayne
  • 3,104
  • 1
  • 22
  • 16