来自 PID 的 Windows 进程
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/8274056/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Windows Process from PID
提问by George Hernando
I'm trying to determine which application or system program is using a particular port on a Windows 2008 R2 machine.
我正在尝试确定哪个应用程序或系统程序正在使用 Windows 2008 R2 机器上的特定端口。
I've run
我跑了
netstat -a -n -o
And have determined that PID is holding open port 445, which I'm interested in.
并确定 PID 持有我感兴趣的开放端口 445。
But when I run tasklistor Microsoft's pslist program, it tells me that the process holding the port open is simply named 'Sys'.
但是当我运行tasklist或 Microsoft 的 pslist 程序时，它告诉我保持端口打开的进程被简单地命名为“Sys”。
Is there another tool or approach I can use to find which is the real process holding it open?
是否有另一种工具或方法可以用来查找打开它的真正过程？
采纳答案by ReinstateMonica Larry Osterman
PID 4 is the system process - if PID 4 is holding a port open, it means that some device driver has opened the port. Given that it's port 445, my guess is that it's the CIFS network filesystem or server. Try doing a "net stop srv" and "net stop rdr" from an elevated command prompt - that should shut down the service using the port.
PID 4 是系统进程 - 如果 PID 4 保持端口打开，则意味着某些设备驱动程序已打开该端口。鉴于它是端口 445，我猜测它是 CIFS 网络文件系统或服务器。尝试从提升的命令提示符执行“net stop srv”和“net stop rdr” - 这应该使用端口关闭服务。
回答by patthoyts
The sysinternals tool procexp (process explorer) shows both processes and if the process is a service - it can show which services are running in the same process. (Windows service processes can contain a number of service threads).
sysinternals 工具 procexp（进程资源管理器）显示两个进程，如果进程是一个服务 - 它可以显示哪些服务正在同一进程中运行。（Windows 服务进程可以包含多个服务线程）。
Port 445 is normally the SMB port for Windows domain activities and file sharing and so on.
端口 445 通常是用于 Windows 域活动和文件共享等的 SMB 端口。
回答by BillMan
Have you looked at TCPView http://technet.microsoft.com/en-us/sysinternals/bb897437? It's another tool from sysinternals.
你看过 TCPView http://technet.microsoft.com/en-us/sysinternals/bb897437吗？这是 sysinternals 的另一个工具。
回答by user1376156
There is a free tool on Nirsoft's website called "CPORTS" with both 32 and 64 bit versions that might help you. Port 445 is used by Server 2008 R2 and later for communicating with other systens using SAMBA /TCP. I got the list below from "cyberciti.biz"
Nirsoft 的网站上有一个名为“CPORTS”的免费工具，包含 32 位和 64 位版本，可能会对您有所帮助。Server 2008 R2 及更高版本使用端口 445 与其他使用 SAMBA /TCP 的系统进行通信。我从“cyberciti.biz”得到以下列表
■netbios-ns - 137/tcp # NETBIOS Name Service ■netbios-dgm - 138/tcp # NETBIOS Datagram Service ■netbios-ssn - 139/tcp # NETBIOS session service ■microsoft-ds - 445/tcp # if you are using Active Directory ■Port 389 (TCP) - for LDAP (Active Directory Mode) ■Port 445 (TCP) - NetBIOS was moved to 445 after 2000 and beyond, (CIFS) ■Port 901 (TCP) - for SWAT service (not related to client communication
■netbios-ns - 137/tcp # NETBIOS 名称服务 ■netbios-dgm - 138/tcp # NETBIOS 数据报服务 ■netbios-ssn - 139/tcp # NETBIOS 会话服务 ■microsoft-ds - 445/tcp # 如果您使用的是 Active目录 ■端口 389 (TCP) - 用于 LDAP (Active Directory 模式) ■端口 445 (TCP) - NetBIOS 在 2000 年及以后移动到 445，(CIFS) ■端口 901 (TCP) - 用于 SWAT 服务（与客户端无关）沟通
If you can run "grep" this is their recommended format: "$ grep -i NETBIOS /etc/services". If not, "AstroGrep" is a little more "user-friendly" Both can be gotten from SourceForge. My own interest lies in a solution to why some systems are unable to map network drives to a server 2008 R2 box yet they have no problem making a VPN connection and running the SQL software on the same server. Port 445 is the one I am most closely looking at due to NETBIOS needs but I really don't have a clue. One person can be unable to map a drive letter from their laptop on their home internet, but then use their cellphone as a tethered modem and map it with no problem. Same system same everything else.
如果您可以运行“grep”，这是他们推荐的格式：“$ grep -i NETBIOS /etc/services”。如果没有，“AstroGrep”更“用户友好” 两者都可以从 SourceForge 获得。我自己的兴趣在于解决为什么有些系统无法将网络驱动器映射到服务器 2008 R2 机器，但它们在建立 VPN 连接并在同一台服务器上运行 SQL 软件时没有问题的解决方案。由于 NETBIOS 的需要，端口 445 是我最密切关注的端口，但我真的不知道。一个人可能无法在他们的家庭互联网上从他们的笔记本电脑映射驱动器号，但随后将他们的手机用作一个系留调制解调器并毫无问题地映射它。相同的系统相同的一切。
I hope one of these helps you, as my problem is still ongoing but the Nirsoft tool is the easiest to use by far and the listed use of grep did give me other information that may be of use to you. The tool from Nirsoft provides an excellent map of all ports in use and plenty of other information. Requires no installation and small enough to keep handy on a flashdrive. Grep or Astrogrep from SourceForge.
我希望其中之一对您有所帮助，因为我的问题仍然存在，但 Nirsoft 工具是迄今为止最容易使用的工具，并且列出的 grep 用法确实为我提供了可能对您有用的其他信息。Nirsoft 的工具提供了所有正在使用的端口和大量其他信息的出色地图。无需安装，体积小，可放在闪存驱动器上随身携带。SourceForge 的 Grep 或 Astrogrep。
Happy Holidays
节日快乐
