User manual WINTERNALS TCPVIEW PROFESSIONAL

[. . . ] TCPView Professional User's Guide Winternals Software LP 3101 Bee Caves Road, Suite 150 Austin, Texas 78746 (512) 330-9130 (512) 330-9131 Fax www. winternals. com Copyright © 2003 Winternals Software LP TCPView Professional User's Guide Table of Contents 1 2 3 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 Overview of TCP/IP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 3. 1 3. 2 TCP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 UDP. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 4 Using TCPView Professional . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 4. 1 4. 2 The Static View . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 The Dynamic View . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . [. . . ] If DNS name resolution is toggled on then the address is shown by name, otherwise it is shown numerically. Remote Address: the remote IP address/port-pair of the endpoint, if applicable. UDP endpoints show "*. *" and TCP endpoints that are not connected show "LISTENING" Sent: the number of messages and bytes sent on an endpoint. The number of messages are shown first, with a slash separating the two numbers. The number of messages are shown first, with a slash separating the two numbers. · · · The first two lines in the sample screen are UDP endpoints, which is the reason that the remote address for these endpoints is shown as "*. *; UDP Winternals Software Page 6 TCPView Professional User's Guide endpoints are connectionless, so they are not associated with any particular remote address. Note that process services. exe (the Windows NT/Windows 2000 Service Control Manager) has sent 1688 messages totalling 91877 bytes over UDP endpoint DUAL:nbname. For instance, process RPSS (the Remote Procedure Call Subsystem) has TCP endpoint DUAL:1026 connected to endpoint DUAL:1025. Instead, it is in the listening state, where the process is waiting for incoming connection requests from remote addresses. 5. 2 Showing Only Connected Endpoints TCPView Professional shows all endpoints, including UDP, TCP connected endpoints, and TCP unconnected endpoints. However, you can toggle the show all endpoints button , or the Options|Show All menu entry, to have TCPView Professional only show connected TCP endpoints. TCPView Professional's default behavior corresponds to the Windows netstat command's -a option. 5. 3 Controlling the Refresh Rate By default TCPView Professional refreshes the contents of the static view once every second. First, you can limit the depth of the display, or the number of records it retains, by setting the history depth with the Configure|History Depth menu entry. You can stop dynamic view from capturing activity by raising the capture button on the toolbar or the Options menu. To clear the dynamic display, or select the Edit|Clear All menu item. press the clear toolbar button By default, the dynamic view scrolls so that it always shows the most recent event. To disable auto-scrolling, raise the Autoscroll button the Options|Autoscroll menu item. , or de-select 6. 3 Sorting You can sort the static view by any column by clicking on the column header. To reverse the order of a column sort, click on the column a second time. Winternals Software Page 10 TCPView Professional User's Guide 7 DNS Name Resolution By default TCPView Professional does not resolve IP addresses to their names or port numbers to their descriptive text. For example, if www. winternals. com has the IP address 10. 0. 0. 1, TCPView Professional will show the numeric representation. Well-defined port numbers have descriptive names; for instance, port 80 is the http port. TCPView Professional has an internal table for translating many port numbers to their names. Select the resolve addresses button or the Options|Resolve Addresses menu entry to toggle name resolution. When name resolution is enabled TCPView Professional performs IP address name lookup operations in the background, updating the static and dynamic views as translations complete. In many cases IP addresses do not have corresponding names, and so are always shown numerically. If a name lookup fails for some reason, TCPView Professional re-attempts the lookup ten seconds later if the address is referenced by new entries in the static or dynamic views, or if you toggle name resolution off and then on again. [. . . ] You can move existing items by selecting them and dragging them to a different position on the same or a different toolbar. Winternals Software Page 21 TCPView Professional User's Guide 13. 3 Adding Items to a Toolbar Use the second tab, Commands, to define the contents of toolbar. Select a category in the left side of the window and the items of that category are shown on the right. Selecting an item has a description of the item appear at the bottom of the dialog. To add an item to a toolbar or menu entry, drag the item from the customization dialog to the desired position on the target toolbar or menu. 13. 4 Controlling Menu Behavior The final tab of the customization dialog lets you choose the type of menu animation TCPView Professional uses, as well as whether or not it organizes menus according to your usage patterns. Winternals Software Page 22 TCPView Professional User's Guide 14 Using TCPVStat TCPView Professional comes with a command-line tool, TCPVStat, that functions like the Windows netstat command, except that it displays the name of the process that owns each endpoint, and can show the amount of data transferred over an endpoint. [. . . ]