Windows 10 pro System is listening on port 80 by TCP and TCPv6. I don't run any web server. Googled a bit and got a little list about couple things such as IIS, w3svc (web publishing service), msDepSvc (web deployment), possibly others I don't recall. I do not have any of those services in services list. What else might it be?
Where do you see it listening? Listening over the LAN, listening on WAN? Port 80 is the port used by any web browser.
Web browsers don't listen on TCP or TCPv6 80 port. They connect to remote TCP or TCPv6 80 port. Maybe try TCPView or similar to find out which process listens on port TCP 80?
As has already been mentioned, a web server normally uses TCP port 80. On W10, the Windows Update agent uses port 80 for HTTP and port 443 for HTTPS to obtain updates. So it might just be W10 checking for updates. Also, some applications on your system may be using BITS over port 80, but as BITS happens in the background, it may only appear as svchost usage in a command prompt. It is nothing to worry about as control is returned to the app once BITS completes its work. FYI... Process – %SystemRoot%\System32\svchost.exe Services – Windows Update Remote ports 80, 443 Process – %SystemRoot%\System32\svchost.exe Service – BITS Remote Ports 80, 443 - Uploads require the IIS web server with BITS server extension on the receiving side. - The version of BITS in Windows 10 supports transfer jobs in PowerShell Remote Sessions.
Open an admin level command prompt window. Then enter the following: netstat -anob This will show all process network connections and their status. If you need further info on what particular service svchost.exe is using, you can use its PID given in the netstat output. Then look for that PID using Process Explorer, Task Manager, etc..
It's a can of worms In my first port I did say System is listening, so this is not about any outgoing connections. @reasonablePrivacy - TCPview said System. @askmark - hmm. Maybe NoScript on SeaMonkey or AppBlock on Vivaldi, but then I'd see those as processes, and also they don't run all the time. @itman - it's not svchost, it's System, as I wrote in my first post. Yes, I did netstat -anob and it "can not obtain ownership information" on pid 4. To confirm, I ran a little android app which can try connection to my laptop's port 80 and it said "Destination is up, port is open". Clear as daylight. So, what is it listening for? I can understand listening on 135 or 445, but this one is weird IMO.
FYI - https://stackoverflow.com/questions/1430141/port-80-is-being-used-by-system-pid-4-what-is-that A number of Win services could be the culprit.
All is quiet now on port 80. It was IIS sitting there, listening, and annoying me. IIS used to be a sevice. Now it's a hard to find feature
Try this one to see active connections per process without needing to search for the PID: Code: Get-NetTCPConnection -State Established | Select-Object -Property LocalAddress, LocalPort, RemoteAddress, RemotePort, State, @{name='Process';expression={(Get-Process -Id $_.OwningProcess).Name}}, CreationTime | Format-Table -AutoSize pause It's for the powershell. (From https://mikefrobbins.com/) Just copy/paste and hit enter. Should show you what process currently receives anything.
Now find out what those are. Please be aware that they are "currently active connections", and not "listening connections", as I said.
