How to find the exact process, which is behind TCP connection to HTTP.SYS process

Question

When I use netstat, I receive info like this - PID 4 means HTTP.SYS

Active Connections

  Proto  Local Address          Foreign Address        State           PID
  TCP    0.0.0.0:80             0.0.0.0:0              LISTENING       4
  TCP    10.140.126.48:80       10.140.126.139:57030   ESTABLISHED     4
  TCP    10.140.126.48:80       10.140.126.181:57918   ESTABLISHED     4
  TCP    [::]:80                [::]:0                 LISTENING       4

So using netsh I can receive info regarding specific listeners on HTTP layer

netsh http show servicestate view=requestq verbose=no

:

Snapshot of HTTP service state (Request Queue View): 
----------------------------------------------------- 

Request queue name: Other Application Pool
    Version: 2.0
    State: Active
    Request queue 503 verbosity level: Limited
    Max requests: 1000
    Number of active processes attached: 1
    Controller process ID: 1216
    Process IDs:
        3684
    URL groups:
    URL group ID: FD00000140000003
        State: Active
        Request queue name: Other Application Pool
            Number of registered URLs: 1
            Registered URLs:
                HTTP://*:80/
        Server session ID: FF00000020000004
            Version: 2.0
            State: Active
    URL group ID: FD00000040000001
        State: Active
        Request queue name: Other Application Pool
            Number of registered URLs: 1
            Registered URLs:
                HTTP://*:80/UI/
        Server session ID: FF00000020000004
            Version: 2.0
            State: Active
    URL group ID: FC00000140000002
        State: Active
        Request queue name: Other Application Pool
            Number of registered URLs: 1
            Registered URLs:
                HTTP://*:80/API2/
        Server session ID: FF00000020000004
            Version: 2.0
            State: Active
Request queue name: Request queue is unnamed.
    Version: 2.0
    State: Active
    Request queue 503 verbosity level: Basic
    Max requests: 1000
    Number of active processes attached: 1
    Process IDs:
        7948
    URL groups:
    URL group ID: F600000040000002
        State: Active
        Request queue name: Request queue is unnamed.
            Number of registered URLs: 1
            Registered URLs:
                HTTP://*:80/ADMINISTRATION/
        Server session ID: F700000020000004
            Version: 2.0
            State: Active

There can be multiple processes listening on the same port, like in this case PID 7948 and 3684.

Is there any possibility to distinguish, to which process belongs each connection to the same port, which is listed in netstat output?

In case of IIS server, it is possible to list active requests by appcmd.exe list requests, but what about other processes?

Is there any API call, to get the info?

How to find the exact process, which is behind TCP connection to HTTP.SYS process

0 Answers0