# Determining source port

Working on a project where I have to determine the source TCP port used for an executable program (Meaning, when the program is running, what TCP port would it use to connect to the remote location).

Now because it's only a project, it isn't a real program. When you run the program you just pops open a cmd prompt window and closes it, almost instantly. I've tried running the program and quickly running Nmap to see what I could see, but the program shuts down too quickly.

I'm only an amateur so I know I am missing something. Would the source code somehow list which TCP port it will use to make the connection? I already know it will connect to port 8080. Or is there a program that logs network/port activity?

I've tried to use PID with command prompt as well to help track the program, but each time it runs, it comes up as a new PID (obviously).

• Have you considered using 'netstat'? – Jeroen Sep 13 '16 at 5:24
• There are OS commands that will let you see the network connections, the ports used, and the executable that launched the socket. – schroeder Sep 13 '16 at 7:18
• What do you actually want to achieve? If the program just uses the most basic code to open a socket, the source port will often be chosen by the OS, so what you're trying to do is pointless. – billc.cn Sep 13 '16 at 13:34
• A TCP socket used for an outgoing connection can never be in listening state, which is the only kind nmap can look for even if you could run it at exactly the right time. If the program does use a fixed port for outgoing connection, which most don't, yes you would see a bind call in the source code -- and the object code. – dave_thompson_085 Sep 13 '16 at 14:08

As the connection is transient, using netstat or similar wont be an option.

If you know at least the name of the executable and/or the destination IP address it connects to, you can run WireShark to capture the traffic.

Although WireShark is confusing to begin with, all you need is the port details which won't be too hard to get.

You need to install WireShark (it will likely want you to install another small app, pcap, that allows it to talk in a special way to the network card). Run it and configure it to only capture data for the single executable and the destination IP address if you know it. Otherwise you will get too much confusing detail to make anything out.

Job done.

I was able to solve my problem by utilizing the TCPview program. Even with the program only opening for a very brief time, it shows the local port and remote port.

Thank you all!