Windows sysinternals

Chapter 13
Network and Communication
Utilities
The utilities described in this chapter focus on network and device connectivity. TCPView is
like a GUI version of the Windows Netstat utility, showing TCP and UDP endpoints on your
system. Whois is a command-line utility for looking up Internet domain registration information
or for performing reverse DNS lookups from IP addresses. And Portmon is a utility
for monitoring serial and parallel port I/O in real time. This chapter does not cover Process
Explorer or Process Monitor, although both include network monitoring functionality. They
are covered in chapters 3 and 4, respectively.
TCPView
TCPView, shown in Figure 13-1, is a GUI program that shows up-to-date and detailed listings
of all TCP and UDP endpoints on your system, including IPv4 and IPv6 endpoints. For each
endpoint, it shows the owning process name and process ID (PID), the local and remote
addresses and ports, and the states of TCP connections. When run with administrative rights,
it also shows the numbers of packets sent and received via those endpoints. Click on any
column header to sort the view by that column.
FIGURE 13-1 TCPView.
By default, TCPView automatically refreshes once per second. You can set the update speed
to two or five seconds via the View menu or turn off automatic refreshing altogether.
Press the space bar to toggle between automatic and manual refresh mode, and press F5
to refresh the view. New endpoints since the previous update are highlighted in green,
www.it-ebooks.info
369