System PID 0 ??

Discussion in 'Port Explorer' started by poogimmal, Jun 4, 2004.

Thread Status:
Not open for further replies.
  1. poogimmal

    poogimmal Registered Member

    Joined:
    May 7, 2004
    Posts:
    79
    system boots as PID 8 on my w2k_sp4. at intermittent times throughout the day I'll see a TCP listed in PE as system PID 0. what might that be. if you need more info, I'll try to gather it next time I see it.
     
  2. Jooske

    Jooske Registered Member

    Joined:
    Feb 12, 2002
    Posts:
    9,713
    Location:
    Netherlands, EU near the sea
    Hi poog
    SYSTEM and *SYSTEM
    netstatsockets? with no own ProcessID
    The PortExplorer Helpfile is my best reference too!
     
  3. poogimmal

    poogimmal Registered Member

    Joined:
    May 7, 2004
    Posts:
    79
    good advice (I did read the worm guard help!)... so much reading, so little time! I might have skimmed the PE help in the not too distant past, but don't recall now -- that's another problem. 1) find time to read, 2) understand what you read, 3) remember what you read/understood. if I did skim it, maybe I did not see obvious reference to PID 0.
    but the short answer is I'm liking PE a lot.

    meanwhile, I booted from knoppix CD I rec'd today, and wow, tools including ethernet. like I said, information overload.
     
  4. Jooske

    Jooske Registered Member

    Joined:
    Feb 12, 2002
    Posts:
    9,713
    Location:
    Netherlands, EU near the sea
    The PortExplorer helpfile really adds to our education; the images between it to make it clear, subjects well written and on topic, so it is handy at times to dig in it and click on some keywords. Socked data overview in this case.
    If you hide the netstat sockets all those SYSTEM sockeds have gone, hence my conclusion.
    You will notice the portnumbers come in pairs: TCP 137 and UDP 137 for example, and so several same port number in the netstat sockets as in the application processes, etc etc.
     
Thread Status:
Not open for further replies.