The program is offered as a portable version and installer by its developers. Both versions offer the same functionality in all other aspects.

The software displays all listening ports, their protocol, process, process ID, associated services and company in the interface. This makes it relatively easy to identify specific ports directly in the program interface. Especially the associated services column can be helpful in identifying the responsible Windows services.

A right-click on a row opens a context menu with additional research options.

• Locate the executable file – Opens the folder that contains the process executable.
• Terminate this process – Terminates the process directly. May only be temporary if the process restarts automatically.
• Process services – Displays all services that are linked to the process.
• Google… – Research the port, process on Google.
• Wikipedia… – Research the port, process on Wikipedia.
• Usage statistics of this port – Look up statistics
• Port authority database – Provides information about most ports.

The menubar on top links to additional tools, commands and references. The tools menu links to Windows apps like the Services managements interface, the Task Manager, Registry Editor or Local Security Settings. Commands can run the netstat command to display all open connections, the task list and the system’s environment variables.

Internet references finally links to essays and white papers about ports and online security. Linked there are for instance BlackViper’s excellent website that is offering services configuration suggestions, lists of common port numbers or a Microsoft guide on how to configure a firewall for domains and trusts.

It is furthermore possible to display a short summary, and to export the current port list in detail. CloseTheDoor offers everything that one could hope for when analyzing open ports on a Windows machine. It is a solid alternative to CurrPorts. The software is compatible with all recent versions of the Microsoft Windows operating system. It tested fine on a 64-bit Windows 7 test system. Downloads of the portable version, installer and source code are available at the project website over at Sourceforge.

A port basically allows communication to or from the device. Characteristics are a port number, an IP address and a protocol type. This article will give you the tools at hand to identify and evaluate the open ports on your Windows system to make a decision in the end whether they can or should be closed or left open.

Software programs and tools that we will use:

• CurrPorts: Available for 32-bit and 64-bit editions of Windows. It is a port monitor that displays all open ports on a computer system. We will use it to identify the ports and the programs that are using them.
• Windows Task Manager: Also used to identify the programs and link some ports to programs.
• Search Engine: Searching for port information is necessary for some ports that cannot be identified that easily.

It would be an impossible task to go through all of the ports that are open, we will therefor use a few examples to enable everyone to understand the process and go on from there.

Fire up CurrPorts and take a look at the populated main area.

The program displays the process name and ID, local port, protocol and local port name among others.

The easiest ports to identify are those with a process name that corresponds to a running program like RSSOwl.exe with the process ID 3216 in the above example that is listing on the local ports 50847 and 52016. Those ports are usually closed when the program closes.

The more important ports are the ones that cannot be linked to a program right away like the System ports shown in the above screenshot.

There are a few ways to identify the services and programs linked to those ports. There are other indicators that we can use to discover the services and applications besides the process name.

The most important ones are the port number, the local port name and the process ID.

With the process ID we can take a look in the Windows Task Manager to try and link it to a process running on the system. To do that you need to start the task manager (press Ctrl Shift Esc). Click on View, Select Columns and enable the PID (Process Identifier) to be shown. That’s the process ID that is also shown in CurrPorts.

Now we can link process IDs in Currports to running processes in the Windows Task Manager.

Let us take a look at some examples:

ICSLAP, TCP Port 2869

Here we have a port that we cannot identify immediately. The local port name is icslap, the port 2869, it uses the TCP protocol, has the process ID 4 and the process name system.

It is usually a good idea to search for the local port name first if it cannot be identified right away. Fire up Google and search for icslap port 2869 or something similar.

Often there are several suggestions or possiblities. For Icslap they are Internet Connection Sharing, Windows Firewall or Local Network Sharing. It took some research to find out that in this case it was used by the Windows Media Player Network Sharing Service.

A good option to find out if this is indeed the case is to stop the service if it is running and refresh the port listing to see if the port is not appearing anymore. In this case it was closed after stopping the Windows Media Player Network Sharing Service.

epmap, TCP port 135

Research shows that it is linked to the dcom server process launcher. Research also shows that it is not a good idea to disable the service. It is however possible to block the port in the firewall instead to close it down.

llmnr, UDP port 5355

If you look in Currports your notice that the local port name llmnr uses the UDP port 5355. PC Library has information on the service. It is referring to the Link Local Multicast Name Resolution protocol which is related to the DNS service. Windows users who do not need the DNS service can disable it in the Services Manager. This closes the ports from being open on the computer system.

Conclusion:

It is not always easy to identify ports and the services or applications they are linked to. Research on search engines usually provides enough information to find out which service is responsible with ways to disable it if it not needed.

A good first approach before starting to hunt down ports would be to take a close look at all started services in the Services Manager and stop and disable those that are necessary for the system. A good starting point to evaluate those is the services configuration page at BlackViper.

It is therefor recommended to regularly check the open ports for computer security reasons. We reviewed CurrPorts (see: Who is connected to your PC right now) a while ago. It is a portable Nirsoft application that will display the open ports along with information needed to conclude if the open ports are needed or not.

My Ports is another application for that purpose. There is not really a big difference between both programs we’d figure it would be nice to have an alternative at hand. My Ports displays all open ports in a list after startup. It uses a table to display various information about each open port on the computer system including the state, local and remote IP address, local and remote port, process name that is listening or using that connection and the process path to that application. It is not as sophisticated as CurrPorts but it does its job just fine.

Most of the open connections can be easily associated with one specific program like Firefox or Skye in the screenshot above. Other ports are listening due to Windows Services or other services that are running. These usually require some investigation on the user’s part to find out if they are needed to operate the computer system. A search on the Internet usually reveals websites that contain information and advice on how to deal with those connections.

My Ports is compatible with most Microsoft operating systems including Windows XP, Windows Vista and Windows 7. It can be downloaded from the developer’s website.

Port forwarding can be configured in the router or traffic controlling device. It basically consists of telling the router route to send incoming traffic to a specific computer by specifying a port and IP address.

One of easiest ways to check if a port is properly forwarded is to use an online port checker like the one provided by uTorrent. To verify the port forwarding open the following url in your web browser http://www.utorrent.com/testport.php?port=1337 and change the number at the end to the port that you want to forward.

The script will check if the port is forwarded properly:

The above screen is displaying that the port forwarding has been properly configured. It will display that an error has occured. The port forwarding test can be repeated after adjusting the configuration settings.

Simple Port Forwarding is a portable software that tries to lessen the knowledge that is needed to configure port forwarding in a computer network. Port Forwarding on the other hand is only a issue of the computers connect to a router that establishes the connection to the Internet.

It basically tells the router where to send information that are being received on a specific port. The software currently supports 197 different routers and the software developer provides the means to suggest new routers if the current router is not available in the list.

Among the support routers are several popular brands like Zyxel, Belkin, Netgear or LinkSys. All the user needs to do is pick his router from the list of available ones and enter the username and password which are used to connect to the admin interface.

Simple Port Forwarding will automatically enter the default values which can be used if the values have not been changed.

The port forwarding software comes with a database of 677 programs that can be automatically added. This includes applications like Yahoo Messenger, Telnet and Teamspeak but mainly games like Age of Conan, Stalker or World of Warcraft.

If the application is not in the list it has to be added manually. All that needs to be done by the user is to pick a name, select a connection type and the start and end port.

The information can then be updated in the router by clicking on the Update Router button. The main advantage of Simple Port Forwarding is the interface and the database that contains lots of popular programs.

The first and one of the most important steps would be to download and install the latest security fixes and services packs. I sometimes have to talk to users in my job (which is somewhat security related as well) and discover that they run Windows XP with the same settings that the pc was shipped with. No updates, outdated anti-virus definitions and the like. You do get the latest patches and fixes for your operating system at windowsupdates.

Make sure you have a valid license otherwise you will not be able to download the updates. A different way would be to use autopatcher which can be downloaded in a version that includes all the updates and fixes already.

The next step would be to turn off unnecessary services and programs that you won’t use. Why should the remote service be active if you never use it ? This reduces the chance of an attacker to get into the system. There are currently 19 services running on my system, if you never tinkered with them before you have probably double that size or even more.

Read the article about turning unnecessary services off, it explains the basics. It is a good idea to turn of the following services if you do not need them

• Telnet
• Universal Plug and Play Device Host
• IIS (not installed by default)
• Netmeeting Remote Desktop Sharing
• Remote Desktop Help Session Manager
• Remote Registry
• Routing & Remote Access
• SSDP Discovery Service

Talking about software. It is wise to not use the default Microsoft products like Outlook Express or Internet Explorer. Those are attacked the most because most of the users use them. (besides offering great ways of attacking them) Alternatives would be Firefox or Opera for Internet Explorer and Thunderbird for Outlook Express.

You should install a anti-virus solution. I do use Antivir but others should be fine as well. The most important aspect is that you keep the definition files up to date. If the software offers automatic updates I suggest you make it update the files once a day.

Firewalls. I do not use them. Well, not a software based firewall that is. I do have a hardware firewall which is all I need. I think that firewalls give the user a false sense of security. They are highly complex and require lots of attention to secure the system. It is not enough to simply install one and click on accept / deny every time a program wants to connect to the internet.

To secure the system you have to add all the tools that should have internet access to the firewall rules with exactly the ports they need. You should close every other port that is not needed by those applications. A good freeware that displays the list of currently open ports is currports.

I think those are the most important steps. If you have more let me know them.

The freeware requires no installation and does not change the system, just run it using the windows run command. Every user that is logged on can use the application, that´s right even guests can use it. Another great tool that uses a gui is Currports. Just follow the link if you like it.

Update: The developer website is no longer available. We have uploaded the latest version of Open Ports Scanner to our own servers. Be advised though that it has not been updated for a long time, and that you may experience issues with the program because of this. We suggest you download CurrPorts instead.

The program lists all open ports on startup. This did not work correctly under a 64-bit Windows test system. Only the protocol and local port were displayed on the system, and not process names, IDs or ports. It is therefor clear that the program is either incompatible with 64-bt editions of Windows, or with newer versions of Microsoft’s operating system.

Connections and processes can be terminated and exported for further analysis. The settings allow you to configure the program to automatically refresh the connection list and ports. If you do not configure that, you are left with manually refreshing the listings.

You can download Open Ports Scanner 1.2 with a click on the following link: Open Ports Scanner (6)

You run it by opening your command prompt and typing netstat. Its highly customizable using switches like netstat -a. Its mainly used to get a quick overview on whats happening on your system connection wise.

The introduction to netstat tutorial is a good essay that features all netstat options and explains the output.

In addition, CurrPorts allows you to close unwanted TCP connections, kill the process that opened the ports, and save the TCP/UDP port information to an HTML file , XML file, or to a tab-delimited text file.

CurrPorts also automatically marks suspicious TCP/UDP ports with pink color. These are usually owned by unidentified applications (Applications without version information and icons)

#only 36K, freeware, no system changes, download and run
#runs on all windows versions but older versions show less details

Update:

Nir Sofer has updated the application constantly ever since we first reviewed it here on Ghacks. Users can now select to run a 32-bit or 64-bit version of the application. CurrPorts at its core has remained more or less the same though.

You can start the portable application directly after you have downloaded and unpacked it on your computer. The program then displays a list of all running processes in its interface. The information are updated in realtime, which means that you can use the program to see if applications that you install or start are trying to phone home or opening ports on your system.

The second option that you have is to check for open ports on the PC that should not be open in first place. You can improve your computer’s security by closing those ports as it reduces the number of attack vectors that attackers have. It is still necessary to research how ports are closed, as this is something that CurrPorts does not help you with.

Windows users can download Currports from the official Nirsoft website. Download Currports