Windows – Why System is Listening on Port 8000

portwindowswindows 7

I noticed by accident today that I have some unknown webserver listening on port 8000. Opening http://localhost:8000 just returns 404, so I don’t get any hint what exactly is listening there.

I’ve used netstat -ano to find out, that the process with PID 4 is listening on that port. PID 4 is the System process. Why is my system listening on that port, without me actually starting a server? Or how can I find out what exactly is listening there?

I’ve read the related questions about port 80 and port 443, but none of the services mentioned there were running on my system. And the other suggestions there didn’t work either.

edit:

The HTTP response of the server lists Microsoft-HTTPAPI/2.0 as the server.

edit2:

As requested by Shadok, here are the entries of TCPView with 8000 as the port. But I doubt it’s useful at all…

TCPView results

Best Answer

IIRC, any program that uses the HTTP Server API to run an HTTP server on Windows will have that service charged to the System process because it's running through the kernel's http.sys server.

You can see the registered URLs by running the following command: netsh http show servicestate. This will include the port number as well.

netstat -ab can also reveal which services started listening on a given port.

Related Question