A. To display which process ID is using a certain TCP port or UDP port, you can start by using the Netstat command with the n (display in numeric form), o (display the owning process ID--this works on Windows XP only), and a (display all connections and listening ports) switches as follows:

  netstat -noa  

For example, the command

  C:\>netstat -noa  

might produce output like the following:

   Active Connections

   Proto Local Address Foreign Address State PID
   TCP 0.0.0.0:135 0.0.0.0:0 LISTENING 888
   TCP 0.0.0.0:445 0.0.0.0:0 LISTENING 4
   TCP 0.0.0.0:1025 0.0.0.0:0 LISTENING 988
   TCP 0.0.0.0:1076 0.0.0.0:0 LISTENING 4
   TCP 0.0.0.0:5000 0.0.0.0:0 LISTENING 1144
   TCP 127.0.0.1:1063 0.0.0.0:0 LISTENING 1380
   TCP 127.0.0.1:1064 0.0.0.0:0 LISTENING 500
   TCP 127.0.0.1:1065 0.0.0.0:0 LISTENING 500
   TCP 127.0.0.1:1199 0.0.0.0:0 LISTENING 356
   TCP 200.200.200.206:139 0.0.0.0:0 LISTENING 4
   TCP 200.200.200.206:1150 0.0.0.0:0 LISTENING 4
   TCP 200.200.200.206:1150 200.200.200.1:139 ESTABLISHED 4
   TCP 200.200.200.206:1152 0.0.0.0:0 LISTENING 4
   TCP 200.200.200.206:1152 200.200.200.200:139 ESTABLISHED 4
   UDP 0.0.0.0:135 *:* 888
   UDP 0.0.0.0:445 *:* 4
   UDP 0.0.0.0:500 *:* 712
   UDP 0.0.0.0:1026 *:* 1124
   UDP 0.0.0.0:1027 *:* 1124
   UDP 0.0.0.0:1028 *:* 712

After you have this information, you can use the Tasklist command to match a particular process ID to a task name. To search for a specific process ID, use the following format:

  C:\> tasklist | findstr <process></process>

A sample command and output might look like

  C:\> tasklist | findstr 712  
  lsass.exe 712 Console 0 1,792 K  

The sample output indicates that the task lsass.exe is using process ID 712. If you're using Windows 2000, you can accomplish the same task by using Tlist instead of Tasklist. (See also, "TCP vs. UDP Ports").