Why my Windows 10 listens on port 80?

Discussion in 'other firewalls' started by act8192, Sep 28, 2018.

  1. act8192

    act8192 Registered Member

    Joined:
    Nov 9, 2006
    Posts:
    1,534
    Windows 10 pro System is listening on port 80 by TCP and TCPv6. I don't run any web server.
    Googled a bit and got a little list about couple things such as IIS, w3svc (web publishing service), msDepSvc (web deployment), possibly others I don't recall. I do not have any of those services in services list. What else might it be?
     
  2. zapjb

    zapjb Registered Member

    Joined:
    Nov 15, 2005
    Posts:
    4,306
    Location:
    USA still the best. But getting worse!
    Really?
     
  3. fax

    fax Registered Member

    Joined:
    May 30, 2005
    Posts:
    3,854
    Location:
    localhost
    Where do you see it listening? Listening over the LAN, listening on WAN?
    Port 80 is the port used by any web browser. :)
     
  4. reasonablePrivacy

    reasonablePrivacy Registered Member

    Joined:
    Oct 7, 2017
    Posts:
    630
    Location:
    Member state of European Union
    Web browsers don't listen on TCP or TCPv6 80 port. They connect to remote TCP or TCPv6 80 port.

    Maybe try TCPView or similar to find out which process listens on port TCP 80?
     
  5. askmark

    askmark Registered Member

    Joined:
    Jul 7, 2016
    Posts:
    353
    Location:
    united kingdom
    Perhaps you have a web filter application listening on port 80 such as Adguard or malwarebytes.
     
  6. emmjay

    emmjay Registered Member

    Joined:
    Jan 26, 2010
    Posts:
    1,320
    Location:
    Triassic
    As has already been mentioned, a web server normally uses TCP port 80.

    On W10, the Windows Update agent uses port 80 for HTTP and port 443 for HTTPS to obtain updates. So it might just be W10 checking for updates.
    Also, some applications on your system may be using BITS over port 80, but as BITS happens in the background, it may only appear as svchost usage in a command prompt. It is nothing to worry about as control is returned to the app once BITS completes its work.
    FYI...
    Process – %SystemRoot%\System32\svchost.exe
    Services – Windows Update
    Remote ports 80, 443
    Process – %SystemRoot%\System32\svchost.exe
    Service – BITS
    Remote Ports 80, 443
    - Uploads require the IIS web server with BITS server extension on the receiving side.
    - The version of BITS in Windows 10 supports transfer jobs in PowerShell Remote Sessions.
     
  7. Umbra

    Umbra Registered Member

    Joined:
    Feb 10, 2011
    Posts:
    4,808
    Location:
    Europe then Asia
    Some Metro Apps use port 80
     
  8. itman

    itman Registered Member

    Joined:
    Jun 22, 2010
    Posts:
    6,766
    Location:
    U.S.A.
    Open an admin level command prompt window. Then enter the following:

    netstat -anob​

    This will show all process network connections and their status. If you need further info on what particular service svchost.exe is using, you can use its PID given in the netstat output. Then look for that PID using Process Explorer, Task Manager, etc..
     
  9. act8192

    act8192 Registered Member

    Joined:
    Nov 9, 2006
    Posts:
    1,534
    It's a can of worms :(
    In my first port I did say System is listening, so this is not about any outgoing connections.
    @reasonablePrivacy - TCPview said System.
    @askmark - hmm. Maybe NoScript on SeaMonkey or AppBlock on Vivaldi, but then I'd see those as processes, and also they don't run all the time.
    @itman - it's not svchost, it's System, as I wrote in my first post. Yes, I did netstat -anob and it "can not obtain ownership information" on pid 4.
    To confirm, I ran a little android app which can try connection to my laptop's port 80 and it said "Destination is up, port is open". Clear as daylight.
    So, what is it listening for? I can understand listening on 135 or 445, but this one is weird IMO.
     
  10. itman

    itman Registered Member

    Joined:
    Jun 22, 2010
    Posts:
    6,766
    Location:
    U.S.A.
  11. act8192

    act8192 Registered Member

    Joined:
    Nov 9, 2006
    Posts:
    1,534
    All is quiet now on port 80.
    It was IIS sitting there, listening, and annoying me.
    IIS used to be a sevice. Now it's a hard to find feature :(
     
  12. Seer

    Seer Registered Member

    Joined:
    Feb 12, 2007
    Posts:
    1,656
    Location:
    Singidunum
    lol that was a good one. Raising a red flag there for a second.
     
  13. __Nikopol

    __Nikopol Registered Member

    Joined:
    Aug 13, 2008
    Posts:
    227
    Location:
    Germany
    Try this one to see active connections per process without needing to search for the PID:
    Code:
    Get-NetTCPConnection -State Established |
    Select-Object -Property LocalAddress, LocalPort, RemoteAddress, RemotePort, State,
                            @{name='Process';expression={(Get-Process -Id $_.OwningProcess).Name}}, CreationTime |
    Format-Table -AutoSize
    pause
    It's for the powershell. (From https://mikefrobbins.com/) Just copy/paste and hit enter. Should show you what process currently receives anything.
     
  14. Tarnak

    Tarnak Registered Member

    Joined:
    Feb 5, 2007
    Posts:
    4,630
  15. __Nikopol

    __Nikopol Registered Member

    Joined:
    Aug 13, 2008
    Posts:
    227
    Location:
    Germany
    Now find out what those are. Please be aware that they are "currently active connections", and not "listening connections", as I said.
     
  16. Tarnak

    Tarnak Registered Member

    Joined:
    Feb 5, 2007
    Posts:
    4,630
    Here we go! They are what I expect, and not untoward. :)

    Powershell_Get_NetTCPConnection_02.JPG
     
  17. __Nikopol

    __Nikopol Registered Member

    Joined:
    Aug 13, 2008
    Posts:
    227
    Location:
    Germany
    You can change the state to "listening", I think. (In the command) Try that. That IS what you want.
     
  18. Tarnak

    Tarnak Registered Member

    Joined:
    Feb 5, 2007
    Posts:
    4,630
    It was "listen". Ergo. :)

    Powershell_Get_NetTCPConnection_04.JPG
     
  19. __Nikopol

    __Nikopol Registered Member

    Joined:
    Aug 13, 2008
    Posts:
    227
    Location:
    Germany
    seems to be gone or the command doesn't show it for some reason. Any ideas?
     
  20. Tarnak

    Tarnak Registered Member

    Joined:
    Feb 5, 2007
    Posts:
    4,630
    I don't understand. What has gone? Are you talking about a link to a site?
     
  21. __Nikopol

    __Nikopol Registered Member

    Joined:
    Aug 13, 2008
    Posts:
    227
    Location:
    Germany
    Sorry I mistook for the OP, act8192
     
Loading...
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.