CurrPorts v1.37
Copyright (c) 2004 - 2008 Nir Sofer
Web site: http://www.nirsoft.net
Description
===========
CurrPorts displays the list of all currently opened TCP/IP and UDP ports
on your local computer. For each port in the list, information about the
process that opened the port is also displayed, including the process
name, full path of the process, version information of the process
(product name, file description, and so on), the time that the process
was created, and the user that created it.
In addition, CurrPorts allows you to close unwanted TCP connections, kill
the process that opened the ports, and save the TCP/UDP ports information
to HTML file , XML file, or to tab-delimited text file.
CurrPorts also automatically mark with pink color suspicious TCP/UDP
ports owned by unidentified applications (Applications without version
information and icons)
Versions History
================
* Version 1.37:
o Fixed bug: CurrPorts failed to display process information when
running under Windows Vista with non-admin user.
o Added Module Filename column (works only on XP/SP2)
* Version 1.36:
o Fixed bug: The main window lost the focus when the user switched
to another application and then returned back to CurrPorts.
* Version 1.35:
o Fixed bug in saving as comma-delimited file when field values
contained comma character.
* Version 1.34:
o New Option: Remember Last Filter (The filter is saved in
cports_filter.txt)
* Version 1.33:
o Added support for saving comma-delimited (.csv) files.
o Added new command-line option: /scomma
* Version 1.32:
o New Option: Start CurrPorts As Hidden (Only when 'Put Icon On
Tray' is turned on)
o New Option: Copy Remote IP Address (F2).
* Version 1.31:
o Fixed bug: TCP and UDP ports with the same number and in the same
process merged into one item.
* Version 1.30:
o New column: Added On - Displays the date that the specified
connection was added.
o New Option: Put Icon On Tray.
o New Option: Log File.
* Version 1.20:
o Added support for filters.
o The settings of CurrPorts utility is now saved to cfg file
instead of using the Registry.
o New command-line options.
o You can now send the information to stdout by specifying an empty
filename ("") in the command-line.
o Added support for x64.
* Version 1.11:
o Added support for process information in Vista.
* Version 1.10:
o A tooltip is displayed when a string in a column is longer than
the column length.
* Version 1.09:
o /close command-line parameter - Close a connection from
command-line
* Version 1.08:
o Fixed columns order bug.
* Version 1.07:
o New option: Resolve the remote IP addresses.
* Version 1.06:
o New column: Process Attributes - Display the file attributes of
the process (H for hidden, R for read-only, and so on)
o Added support for working with IPNetInfo utility
* Version 1.05:
o Fixed bug: identify process path starting with '\??\'
* Version 1.04:
o Added more accelerator keys.
o Added support for Windows XP visual styles.
* Version 1.03:
o New Option: Display Listening
o New Option: Display Established
o New Option: Display Items With Unknown State
o New Option: Display Items Without Remote Address
* Version 1.02:
o Fixed bug: "Exception C0000005" message when running CurrPorts on
Windows NT/2000 without administrator rights.
o New column: "Process Services" - Displays the list of services of
a process.
* Version 1.01:
o The 'Copy Selected Items' option now copies the ports data in
tab-delimited format, so you can instantly paste the data into your
Excel worksheet.
o Improvment in ports to process binding under Windows 2000.
Process information is now also displayed under Windows NT.
* Version 1.00: First release.
System Requirements
===================
This utility works perfectly under Windows NT, Windows 2000, Windows XP,
Windows Server 2003, And Windows Vista. If you want to use this utility
on Windows NT, you should install psapi.dll in your system32 directory.
You can also use this utility on older versions of Windows (Windows
98/ME), but in these versions of Windows, the process information for
each port won't be displayed.
Using CurrPorts
===============
CurrPorts utility is a standalone executable, and it doesn't require any
installation process or additional DLLs. In order to start using it, just
copy the executable file (cports.exe) to any folder you like, and run it.
The main window of CurrPorts displays the list of all currently opened
TCP and UDP ports. You can select one or more items, and then close the
selected connections, copy the ports information to the clipboard, or
save it to HTML/XML/Text file. If you don't want to view all available
columns, or you want to change the order of the columns on the screen and
in the files you save, select 'Choose Column' from the View menu, and
select the desired columns and their order. In order to sort the list by
specific column, click on the header of the desired column.
The Options Menu
================
The following options are available under the Options menu:
* Display Listening: If this option is enabled, all listening ports are
displayed.
* Display Established: If this option is enabled, all established
connections are displayed.
* Display Closed: If this option is enabled, closed ports (with 'Time
Wait', 'Close Wait', or 'Closed' state) are displayed.
* Display Items With Unknown State: If this option is enabled, items
with unknown state (the state column is empty) are displayed.
* Display Items Without Remote Address: If this option is enabled,
disconnected ports with no remote address are displayed.
* Display TCP Ports: If this option is disabled, TCP ports won't be
displayed in the ports list.
* Display UDP Ports: If this option is disabled, UDP ports won't be
displayed in the ports list.
* Mark Ports Of Unidentified Applications: If this option is enabled,
all TCP/UDP ports that opened by applications with no version
information and with no icons, are automatically marked with pink
color. If you have on your system one or more ports marked with pink
color, you should deeply check the processes that created these ports.
It could be only an innocent application that simply doesn't contain
any icons and version information (For example: the executables of
MySQL and Oracle servers don't contain any icons or version info, so if
you have MySQL/Oracle servers on your system, the ports they open will
be marked.) , but it can also be a trojan or other unwanted application
that infiltrated into your system.
* Mark New/Modified Ports: If this option is enabled, each time the
ports list is refreshed, all newly added ports and existing ports with
changes are marked with green color.
* Auto Refresh: Allows you to automatically refresh the opened ports
list each 2, 4, 6, 8, or 10 seconds.
* Sort On Auto Refresh If this option is enabled, the entire ports list
is sorted each time that the list is refreshed automatically.
Otherwise, new/modified ports are added to the bottom of the list.
Using Filters
=============
Starting from version 1.20, you can monitor only the opened ports that
you need, by using the "Advanced Filters" option (Options -> Advanced
Filters).
In the filters dialog-box, you can add one or more filter strings
(separated by spaces, semicolon, or CRLF) in the following syntax:
[include | exclude] : [local | remote | both | process] : [tcp | udp |
tcpudp] : [IP Range | Ports Range]
Here's some examples that demonstrate how to create a filter string:
* Display only packets with remote tcp port 80 (Web sites):
include:remote:tcp:80
* Display only pa
