CurrPorts displays the list of all currently opened TCP/IP and UDP ports on your local computer. For each port in the list, information about the process that opened the port is also displayed, including the process name, full path of the process, version information of the process (product name, file description, and so on), the time that the process was created, and the user that created it.
In addition, CurrPorts allows you to close unwanted TCP connections, kill the process that opened the ports, and save the TCP/UDP ports information to HTML file , XML file, or to tab-delimited text file.
CurrPorts also automatically mark with pink color suspicious TCP/UDP ports owned by unidentified applications (Applications without version information and icons)
Using CurrPorts
CurrPorts utility is a standalone executable, and it doesn’t require any installation process or additional DLLs. In order to start using it, just copy the executable file (cports.exe) to any folder you like, and run it.
The main window of CurrPorts displays the list of all currently opened TCP and UDP ports. You can select one or more items, and then close the selected connections, copy the ports information to the clipboard, or save it to HTML/XML/Text file.
If you don’t want to view all available columns, or you want to change the order of the columns on the screen and in the files you save, select ‘Choose Column’ from the View menu, and select the desired columns and their order. In order to sort the list by specific column, click on the header of the desired column.
Starting from version 1.20, you can monitor only the opened ports that you need, by using the “Advanced Filters” option (Options -> Advanced Filters).
In the filters dialog-box, you can add one or more filter strings (separated by spaces, semicolon, or CRLF) in the following syntax:
[include | exclude] : [local | remote | both | process] : [tcp | udp | tcpudp] : [IP Range | Ports Range]
Here’s some examples that demonstrate how to create a filter string:
- Display only packets with remote tcp port 80 (Web sites):
include:remote:tcp:80 - Display only packets with remote tcp port 80 (Web sites) and udp port 53 (DNS):
include:remote:tcp:80
include:remote:udp:53 - Display only packets originated from the following IP address range: 192.168.0.1 192.168.0.100:
include:remote:tcpudp:192.168.0.1-192.168.0.100 - Display only TCP and UDP packets that use the following port range: 53 – 139:
include:both:tcpudp:53-139 - Filter most BitTorrent packets (port 6881):
exclude:both:tcpupd:6881 - Display only the opened ports of FireFox browser:
include:process:firefox.exe
Command-Line Options for CurrPorts
/stext <Filename>
- Save the list of all opened TCP/UDP ports into a regular text file.
/stab <Filename> – Save the list of all opened TCP/UDP ports into a tab-delimited text file.
/stabular <Filename> – Save the list of all opened TCP/UDP ports into a tabular text file.
/shtml <Filename> – Save the list of all opened TCP/UDP ports into HTML file (Horizontal).
/sverhtml <Filename> – Save the list of all opened TCP/UDP ports into HTML file (Vertical).
/sxml <Filename> – Save the list of all opened TCP/UDP ports to XML file.
/filter <filter string> – Start CurrPorts with the specified filters. If you want to specify more than one filter, use the ‘;’ character as a delimiter.
/cfg <cfg filename> – Start CurrPorts with the specified config file.
Here’s some examples:
- Save all opened TCP/IP ports created by Internet Explorer browser to
HTML file:
cports.exe /filter “include:process:iexplore” /shtml
“c:\temp\ports.html” - Add all opened ports information to ports.txt (as tab-delimited text
file). This example only works when running it from a command-prompt
window.
cports.exe /stab “” >> c:\temp\cports1.txt - Start CurrPorts with filter that will only display the opened ports
of Internet Explorer and FireFox:
cports.exe /filter “include:process:firefox;include:process:iexplore”
Closing a Connection From Command-Line
Starting from version 1.09, you can close one or more connections from command-line, by using /close parameter.
The syntax of /close command:
/close <Local Address> <Local Port> <Remote Address> <Remote Port>
For each parameter, you can specify “*” in order to include all ports or addresses.
Examples:
- Close all connections with remote port 80 and remote address 192.168.1.10:
/close * * 192.168.1.10 80 - Close all connections with remote port 80 (for all remote addresses):
/close * * * 80 - Close all connections to remote address 192.168.20.30:
/close * * 192.168.20.30 * - Close all connections with local port 80:
/close * 80 * *
