Quick – how do you tell how many connections does your box have over say port 445(SMB)or whether that port is really closed?
Or for any other port like 80?
The quickest way I have seen is simply using netstat from command prompt although applying a filter for ports that we want to find out.[Of course we can go to Windows Firewall and then check,but it has too many clicks involved :)]
Let’s say I want to see if TCP port 445 which basically in Windows XP is used to run server message block (SMB) protocol directly on top of TCP/IP without using NetBT.
To find out if I really have port 445 open and also the instances of connections that have this port,what I do is :
1.Open command prompt (Start>Run>cmd).
2.In the command prompt window,I type :
netstat -ano|find “445”
3.To get the instances of all connections using 445,I use the /c switch in find :
netstat -ano|find/c “445”
The above two commands with filter on port will tell me if I am really having port 445 open and if yes then how many connections are actually using it.In this case,my box has 2 instances of connections that involve port 445 which is already open.
As seen,the “find” command in Windows is highly useful when it comes to piping outputs from various commands and can also be used to set selective filters.
Happy port hunting.
Peace.