User manual WINTERNALS TCPVIEW PROFESSIONAL

[. . . ] TCPView Professional User's Guide Winternals Software LP 3101 Bee Caves Road, Suite 150 Austin, Texas 78746 (512) 330-9130 (512) 330-9131 Fax www. winternals. com Copyright © 2003 Winternals Software LP TCPView Professional User's Guide Table of Contents 1 2 3 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 Overview of TCP/IP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 3. 1 3. 2 TCP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 UDP. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 4 Using TCPView Professional . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 4. 1 4. 2 The Static View . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 The Dynamic View . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . [. . . ] The number of messages are shown first, with a slash separating the two numbers. Received: the number of messages and bytes received on an endpoint. The number of messages are shown first, with a slash separating the two numbers. · · · The first two lines in the sample screen are UDP endpoints, which is the reason that the remote address for these endpoints is shown as "*. *; UDP Winternals Software Page 6 TCPView Professional User's Guide endpoints are connectionless, so they are not associated with any particular remote address. Note that process services. exe (the Windows NT/Windows 2000 Service Control Manager) has sent 1688 messages totalling 91877 bytes over UDP endpoint DUAL:nbname. The next four entries are connected TCP endpoints. For instance, process RPSS (the Remote Procedure Call Subsystem) has TCP endpoint DUAL:1026 connected to endpoint DUAL:1025. Finally, the last line is a TCP endpoint that is not connected. Instead, it is in the listening state, where the process is waiting for incoming connection requests from remote addresses. 5. 2 Showing Only Connected Endpoints TCPView Professional shows all endpoints, including UDP, TCP connected endpoints, and TCP unconnected endpoints. However, you can toggle the show all endpoints button , or the Options|Show All menu entry, to have TCPView Professional only show connected TCP endpoints. TCPView Professional's default behavior corresponds to the Windows netstat command's -a option. 5. 3 Controlling the Refresh Rate By default TCPView Professional refreshes the contents of the static view once every second. First, you can limit the depth of the display, or the number of records it retains, by setting the history depth with the Configure|History Depth menu entry. You can stop dynamic view from capturing activity by raising the capture button on the toolbar or the Options menu. To clear the dynamic display, or select the Edit|Clear All menu item. press the clear toolbar button By default, the dynamic view scrolls so that it always shows the most recent event. To disable auto-scrolling, raise the Autoscroll button the Options|Autoscroll menu item. , or de-select 6. 3 Sorting You can sort the static view by any column by clicking on the column header. To reverse the order of a column sort, click on the column a second time. Winternals Software Page 10 TCPView Professional User's Guide 7 DNS Name Resolution By default TCPView Professional does not resolve IP addresses to their names or port numbers to their descriptive text. For example, if www. winternals. com has the IP address 10. 0. 0. 1, TCPView Professional will show the numeric representation. Well-defined port numbers have descriptive names; for instance, port 80 is the http port. TCPView Professional has an internal table for translating many port numbers to their names. Select the resolve addresses button or the Options|Resolve Addresses menu entry to toggle name resolution. When name resolution is enabled TCPView Professional performs IP address name lookup operations in the background, updating the static and dynamic views as translations complete. In many cases IP addresses do not have corresponding names, and so are always shown numerically. If a name lookup fails for some reason, TCPView Professional re-attempts the lookup ten seconds later if the address is referenced by new entries in the static or dynamic views, or if you toggle name resolution off and then on again. [. . . ] option. TCPView Stat v1. Ø Copyright (C) 2000 Winternals Software LP http://www. winternals. com usage: tcpvstat [-n] [-a] [-p] [-d] [<processname> or <address>] process Show endpoints for matching processed or address address (partial name or address accepted). -d Show detailed information. Winternals Software Page 23 TCPView Professional User's Guide 15 Frequently Asked Questions Why does the endpoint information shown in TCPView Professional's static view differ from what I see with netstat or TCPView?Netstat has a different interpretation of endpoints than TCPView Professional. TCPView Professional's display is actually more accurate than netstat's. [. . . ]