10

The port 9001 seems to be used by Microsoft-HTTPAPI/2.0. I get this from the browser doing a http://localhost:9001/

HTTP/1.1 404 Not Found
Content-Type: text/html; charset=us-ascii
Server: Microsoft-HTTPAPI/2.0
Date: Thu, 09 Apr 2020 08:10:11 GMT
Connection: close
Content-Length: 315

Using netstat -aonb | grep 9001:

  TCP    0.0.0.0:9001           0.0.0.0:0              LISTENING       4
  TCP    [::]:9001              [::]:0                 LISTENING       4
  TCP    [::1]:9001             [::1]:50916            TIME_WAIT       0
  TCP    [::1]:9001             [::1]:50957            TIME_WAIT       0

So PID 4 is ntoskrnl.exe.

I checked that Internet Information Service is off

enter image description here

How could I investigate further ? Thank you for your help

Stéphane Gerber
  • 291

1 Answers1

9

After Daniel B comment I did the following:

$ netsh http show servicestate                                                      

Snapshot of HTTP service state (Server Session View):                               
-----------------------------------------------------                               

Server session ID: FF00000520000001                                                 
    Version: 2.0                                                                    
    State: Active                                                                   
    Properties:                                                                     
        Max bandwidth: 4294967295                                                   
        Timeouts:                                                                   
            Entity body timeout (secs): 120                                         
            Drain entity body timeout (secs): 120                                   
            Request queue timeout (secs): 120                                       
            Idle connection timeout (secs): 120                                     
            Header wait timeout (secs): 120                                         
            Minimum send rate (bytes/sec): 150                                      
    URL groups:                                                                     
    URL group ID: FE00000540000001                                                  
        State: Active                                                               
        Request queue name: Request queue is unnamed.                               
        Properties:                                                                 
            Max bandwidth: inherited                                                
            Max connections: inherited                                              
            Timeouts:                                                               
                Timeout values inherited                                            
            Number of registered URLs: 1                                            
            Registered URLs:                                                        
                HTTP://+:9001/IGCC/SERVICE/                                         

Request queues:                                                                     
    Request queue name: Request queue is unnamed.                                   
        Version: 2.0                                                                
        State: Active                                                               
        Request queue 503 verbosity level: Basic                                    
        Max requests: 1000                                                          
        Number of active processes attached: 1                                      
        Process IDs:                                                                
            5592

And now I get the culprit Process IDs: 5592, IGGC/Service stands for
Intel Graphic Command Center

Stéphane Gerber
  • 291