Port Explorer - tips and tricks!

Discussion in 'Port Explorer' started by Wayne - DiamondCS, Mar 23, 2004.

Thread Status:
Not open for further replies.
  1. Wayne - DiamondCS

    Wayne - DiamondCS Security Expert

    Joined:
    Jul 19, 2002
    Posts:
    1,533
    Location:
    Perth, Oz
    Determine When A Process Was Started
    There is a very easy trick to determining when a process started - simply right-click on the process in Port Explorer and select the 'What Is (process)' menu. A dialog will display with the properties of that process. Now, look at the ACCESSED timestamp on the process -- in most cases, this will be the time that the process was started, and is accurate to within 1 second.

    Determine Which Process Is Hogging Your Modem
    Users on modems may often see their upload light blinking away erratically and wonder 'Which process is sending all that data?'. Port Explorer makes this easy to see - simply ensure that Port Explorer's refresh rate is relatively fast (1-5 seconds is recommended) and then visually browse through the 'Sent' column - what you're looking for is a socket with a Sent count that is continually incrementing. There'll probably only be one that is rising noticeably, this is almost certainly the process that is hogging your modem and sending all that data. To see what data is being sent, simply use the Socket Spy utility.

    Preventing A Process From Being Able To Send Data
    Preventing a process (or even an individual socket) from being able to send (or receive) data is very easy with Port Explorer -- simply right-click on the process or socket you wish to block, and click on the 'Block Sending' menu from the Socket or Process menu branches.

    Slow\restrict the speed of a socket or process
    The Bandwidth Throttling capability of Port Explorer allows you to restrict the speed that a socket or process can send and\or receive data - a capability exclusive to Port Explorer. Simply right-click on the socket or process you want to restrict, choose the Socket or Process submenu, then select Max Send Speed or Max Recv Speed.

    Closing An Established Connection
    Port Explorer gives you the precise ability to terminate/close individual sockets (without affecting or terminating the target program). To close a connection, simply right-click on the socket you wish to close, and select the 'Kill Socket' menu from the Socket menu branch.

    Detect which country an IP address belongs to
    Port Explorer has automatic IP-to-Country resolving (look in the Country column in the main window), but you can also use this feature on-demand simply by using the Lookup utility (from the Utilities menu), and selecting IP to Country.

    Find The Owner Of A Domain
    So you've seen a strange connection to your machine from a machine such as 'pc1.xyzhost.com'. This begs the question - who is xyzhost.com, who owns the domain, and who can I contact? The WHOIS utility that comes with Port Explorer makes obtaining this information this very easy. Simply start the Whois utility and do an Automatic Search for xyzhost.com. Within a matter of seconds you'll be presented with owner/contact information about that domain, including an email address to contact.

    Sortable Column Headers
    A very simple yet powerful feature - Port Explorer's built-in automatic sorting capability allows you to easily sort the data being displayed (ie. from lowest to highest, from newest to oldest, in alphabetical order, etc.). For example, clicking on the Local Port column will cause all data to be shown in the order of the local port corresponding with each socket, showing the ports with the lowest values at the top . Clicking on Local Port again will reverse the order, showing the ports with the lowest values at the bottom. Clicking on the 'Creation' column allows you to easily see the sockets which were most recently created - they'll be at the top of the list. This is a very simple feature yet it makes viewing socket data dramatically easier - take advantage of it!

    Interchangeable Column Headers
    You can easily change the position/order of the column headers in the main Port Explorer display (such as 'Process', 'ProcessID', 'Protocol' etc.) simply by dragging them with your mouse. For example, if you're not very interested in how many bytes have been sent/received, you may wish to move the 'Sent' and 'Received' columns to the far right. The column orders are automatically remembered by Port Explorer.

    Extended Whois Information
    The next time you use Port Explorer's Whois utility, change the search from Automatic over to a manual server, such as "Australia (.au)". Enter "help" as the search query, and press the Search button -- the Whois server should return extended information about different ways to query it's database. This allows you to then perform more precise searches. Other queries such as "?" may also work - commands vary from server to server.

    Saving/Loading Socket Spy Packet Logs
    The data logged by Socket Spy is automatically saved to capture.bin in your Port Explorer directory. You can make a backup of this file at any time you wish, and can also overwrite capture.bin with an existing copy to restore previously-captured data.

    Freeze The Port Explorer Display
    There may be many times when you use software (not just Port Explorer) that you wish you could freeze the program so that you could take a snapshot, such as a screen capture. Port Explorer makes this easy - simply press F2 (or select 'Pause Display' in the Settings menu), and Port Explorer will stop updating it's display, essentially running in paused mode. Then you can easily make a screen capture or even save the table data by selecting 'Save Table' from the File menu. Pressing F2 again will unfreeze and allow Port Explorer to update the display.

    Command Line Options
    To use these command line options you must specify them when you start Port Explorer (by modifying the shortcut to Port Explorer, or by implicitly declaring the parameters from the command line).
    -m Adding this will make Port Explorer start minimized to the systray as long as you have "Minimize to Systray" option enabled in Port Explorer.
    Example: d:\program files\port explorer\portexplorer.exe -m

    Log Path
    By default, Port Explorer saves the network activity logfile to PELOG.TXT in the Port Explorer directory. You can manually override this by creating a REG_SZ registry value called "Log Path" in HKEY_LOCAL_MACHINE\DIAMOND COMPUTER SYSTEMS\PORT EXPLORER\, the value being the full path to the desired logfile (ie. c:\mypelog.txt)

    ... have fun :)
     
  2. tutankamon

    tutankamon Registered Member

    Joined:
    Jul 10, 2003
    Posts:
    170
    Location:
    Lancashire U.K.
    Hi Wayne,
    Excellent tips for P.E. I am now going to write a book on "Hints and Tips For Port Explorer" and publish it, then make a £million. Only joking!! Thanks for the tips, very useful. (any other tips for other DiamondCS products would be very welcome)
     
  3. Wayne - DiamondCS

    Wayne - DiamondCS Security Expert

    Joined:
    Jul 19, 2002
    Posts:
    1,533
    Location:
    Perth, Oz
    The single most powerful tip I can give anyone in regards to a DiamondCS program is read the helpfile!
    The tips above, for example, are taken directly from the helpfile. We try to document as much as we can (without unnecessary overload) in our helpfiles and always include as many tips and tricks as we can think of, but that's all we can do -- it's then up to you, the program user, to actually read it to learn those secrets. I think you'll be pleasantly surprised by what you might learn. :)
     
  4. tutankamon

    tutankamon Registered Member

    Joined:
    Jul 10, 2003
    Posts:
    170
    Location:
    Lancashire U.K.
    Hi Wayne,
    Yes you are correct, I normaly go to the help file when something seems wrong. It is the old saying "Read the Instructions First" ......point taken.
     
  5. didcrywolf

    didcrywolf Registered Member

    Joined:
    May 26, 2004
    Posts:
    1
    Location:
    Montreal
    I need to restore a killed process, where do I go to do that?
     
  6. Jooske

    Jooske Registered Member

    Joined:
    Feb 12, 2002
    Posts:
    9,713
    Location:
    Netherlands, EU near the sea
    Hi there didcrywolf and welcome to the forum!
    How about starting the process again from it's executable?
     
  7. Valkyri001

    Valkyri001 Registered Member

    Joined:
    Feb 15, 2004
    Posts:
    300
    Location:
    Friendswood Tx. 77546
    o_O What could be causing or causes sockets to suddenly go dead o_O
     
  8. Gavin - DiamondCS

    Gavin - DiamondCS Former DCS Moderator

    Joined:
    Feb 10, 2002
    Posts:
    2,080
    Location:
    Perth, Western Australia
    Socket no longer in use ? whatever program used it, closed it
    Please start a new thread if you have issues and keep this thread for tips only
     
Thread Status:
Not open for further replies.