Portqry download

Port 389)NetBIOS Adapter status query (UDP port 137)In these cases, PortQry uses an ephemeral port for the second test. When this occurs, PortQry records "Using ephemeral source port" in its output.If the computer where PortQry is installed also runs the IPSec policy agent, UDP port 500 may not be available to use as a source port. To temporarily turn off the IPSec policy agent so that you can use port 500, run net stop PolicyAgent. When you have finished testing, run net start PolicyAgent.-cn !!Query an SNMP communityThe community_name> value represents the name of the SNMP community to query. You must delimit this value by using exclamation points, as shown in the left column.If the SNMP service is not listening on the target port, PortQry ignores -cn.The default community name is public.-qRun PortQry in quiet modeWhen you use -q, PortQry suppresses all screen output except for error messages.To see output other than error messages, use -q together with -l. PortQry records the normal output in the log file.If a log file already exists and you use -q together with -l, PortQry overwrites the existing log file without prompting you.You cannot use -q together with -o, -r, or -p both.This parameter is especially helpful when you use a batch file to run a PortQry command string.Remarks for parameters in command-line modeAny port number value must be a valid port number between 1 and 65535, inclusive.The -e, -o, and -r parameters are mutually exclusive. A single PortQry command can use only one of these parameters.A query to UDP port 389 (LDAP) might not work against domain controllers that are running Windows Server 2008. To check the availability of the service that's running on UDP port 389, you can use Nltest instead of PortQry. For more information, see Nltest.When you query port 135 (RPC) by using -e or -o, PortQry returns all the endpoints that are currently registered with the RPC endpoint mapper.ImportantWhen you use the -r, PortQry doesn't query the RPC endpoint mapper.When you query port 53 (DNS), PortQry sends a DNS query for portqry.microsoft.com by using both TCP and UDP. If the server returns a response, PortQry determines that the port is LISTENING.NoteIt's not important whether the DNS server returns a positive or negative response. Any response indicates that the port is listening.Using PortQry in local (command-line) modeInstead of querying a port on a remote target computer, you can use PortQry

Udp, or both).The default value is tcp.-e Specify the target port (also known as "endpoint")The port_number> value represents the port to query on the destination computer.The default value is 80.-o ,Specify multiple target ports in a sequenceThe port_number>,port_number> values represent comma-delimited list of port numbers to query in a sequence. Do not use spaces around the commas.-r :Specify a range of target portsThe port_number>:port_number> values represent the starting and ending port numbers, separated by a colon. Do not use spaces around the colon.The starting port number must be smaller than the ending port number.-l Generate a log fileThe filename.txt> value represents the name and extension of the log file. This value cannot include spaces.When the command runs, PortQry creates the log file in the directory where it's installed.If the file already exists, PortQry asks you to confirm that you want to overwrite it (unless you also use the -y parameter).-yOverwrite previous log fileWhen you use -y together with -l, PortQry overwrites the existing log file without prompting you to confirm the action.If the PortQry command string does not include -l, PortQry ignores -y.-slWait extra time for response (also known as slow link delay)Use this parameter to double the time that PortQry waits for a response from a UDP port before PortQry determines that the port is NOT LISTENING or that it's FILTERED. When you query over slow or unreliable network links, the normal wait time may be too short to receive a response.-nrSkip reverse name lookupBy default, when you use -n to specify an IP address for the target computer, PortQry does a reverse name lookup to resolve the IP address to a name. This process may be time-consuming, especially if PortQry can't resolve the IP address. Use -nr to skip this step of the query.If you use -n to specify a computer or domain name, PortQry ignores -nr.-sp Query from a specific source portThe port_number> value represents the port that PortQry uses to send the query.PortQry can't use a port that another process is already using. If the port that you specify is already in use, PortQry returns the following error message:Cannot use specified source port.Port is already in use.Specify a port that is not in use and run the command again.In the following cases, PortQry uses the specified port for the first test of the query, but not the second test: RPC (TCP and UDP ports 135)LDAP (UDP

443 -nr -l pqlog.txt -q:endWhen this batch file runs, PortQry produces a log file that is named pqlog.txt. The content of this file resembles the following:PortQry Version 2.0 Log FileSystem Date: Thu Sep 16 10:35:03 2021Command run: portqry -n 169.254.18.22 -e 443 -nr -l pqlog.txt -qLocal computer name: SOURCESERVERQuerying target system called: 169.254.18.22TCP port 443 (https service): LISTENING========= end of log file ========= Query port 135 (RPC service)The following command queries UDP port 135 on the myServer computer. By default, the RPC service should be listening on this port.portqry -n myServer -p udp -e 135As a result, PortQry takes the following actions:PortQry uses the Services file in the %SYSTEMROOT%\System32\Drivers\Etc folder to resolve UDP port 135 to a service. Using the default configuration, PortQry resolves the port to the RPC endpoint mapper service (Epmap).PortQry sends an unformatted user datagram to UDP port 135 on the destination computer.PortQry doesn't receive a response from the target port. This is because the RPC endpoint mapper service responds only to a correctly formatted RPC query. PortQry reports that the port is LISTENING or FILTERED.PortQry creates a correctly formatted RPC query that requests all the endpoints that are currently registered with the RPC endpoint mapper. PortQry sends this query to to UDP port 135 on the destination computer.Depending on the response, PortQry takes one of the following actions:If PortQry receives a response to this query, PortQry returns the whole response to the user and reports that the port is LISTENING.If PortQry doesn't receive a response to this query, it reports that the port is FILTERED.UDP port 135 (epmap service): LISTENING or FILTERED Querying Endpoint Mapper Database... Server's response: UUID: 50abc2a4-574d-40b3-9d66-ee4fd5fba076ncacn_ip_tcp:169.254.12.191[4144]UUID: ecec0d70-a603-11d0-96b1-00a0c91ece30 NTDS Backup Interfacencacn_np:\\MYSERVER[\PIPE\lsass]UUID: e3514235-4b06-11d1-ab04-00c04fc2dcd2 MS NT Directory DRS Interfacencacn_ip_tcp:169.254.12.191[1030]UUID: e3514235-4b06-11d1-ab04-00c04fc2dcd2 MS NT Directory DRS Interfacencadg_ip_udp:169.254.12.191[1032]UUID: 12345678-1234-abcd-ef00-01234567cffbncacn_np:\\MYSERVER[\PIPE\lsass]UUID: 12345678-1234-abcd-ef00-01234567cffbncacn_np:\\MYSERVER[\PIPE\POLICYAGENT]Total endpoints found: 6==== End of RPC Endpoint Mapper query response ====UDP port 135 is LISTENINGFrom this output, you can determine not only whether the service is listening on the port, but also which services or programs are registered with the RPC endpoint mapper database on the destination computer. The output includes the universal unique identifier (UUID) for each program, the annotated name (if one exists), the protocol that each program uses, the network address that the program is bound to, and the program's endpoint in square brackets.NoteWhen you specify the -r option in the PortQry command to scan a range of ports, PortQry doesn't query the RPC endpoint

The query destination, PortQry resolves the IP address to a name. If you change this option, PortQry skips the name resolution step.To turn reverse name lookup on again, run set nr a second time.set slTurn slow link delay on or offIf you change this option, PortQry doubles the length of time that it waits for a response from a UDP port before PortQry determines that the port is NOT LISTENING or that it's FILTERED. When you query over slow or unreliable network links, the normal wait time may be too short to receive a response.To turn slow link delay off again, run set sl a second time.Suppose you want to query a computer that has the IP address 10.0.1.10. At the interactive mode command prompt, enter n 10.0.1.10. This command produces output that resembles the following excerpt:Default Node: 10.0.1.10>To send a DNS query, enter q dns at the interactive mode command prompt. This command produces output that resembles the following excerpt:resolving service name using local services file...UDP port resolved to the 'domain' serviceIP address resolved to myserver.contoso.comquerying...UDP port 53 (domain service): LISTENING>Customizing the association between ports and servicesBy default, every Windows-based computer has a Services file that's located in the %SYSTEMROOT%\System32\Drivers\Etc folder. PortQry uses this file to resolve port numbers to their corresponding service names. PortQry uses this information to select the format for its queries. You can edit this file to direct PortQry to send formatted messages to an alternative port. For example, the following entry appears in a typical Services file:ldap 389/tcp #Lightweight Directory Access ProtocolYou can edit this port entry or add an additional entry. To force PortQry to send LDAP queries to port 1025, modify the entry as follows:ldap 1025/tcp #Lightweight Directory Access ProtocolExamplesThe following examples demonstrate how to use PortQry and its parameters:Local modeQuery the local computerQuery the local computer when access may be restrictedMonitor a process ID by using a specific intervalQuery over a slow linkCommand-line modeSpecify a target and protocolSpecify one or more target portsSpecify a log file for PortQry outputUse a batch file to run PortQry in quiet modeQuery port 135 (RPC service)Query the local computerThe output of portqry -local resembles the following excerpt:TCP/UDP Port Usage96 active ports foundPort Local IPState Remote IP:Port TCP 80 0.0.0.0 LISTENING 0.0.0.0:18510 TCP 80 169.254.149.9 TIME WAIT 169.254.74.55:3716 TCP 80 169.254.149.9 TIME WAIT 169.254.200.222:3885 TCP 135 0.0.0.0 LISTENING 0.0.0.0:10280 UDP 135 0.0.0.0 : UDP 137 169.254.149.9

On a computer that's specified by using its computer name:portqry -n myServer -p udpThe following command queries the default TCP and UDP ports of a computer that's specified by using its IP address:portqry -n 192.168.1.20 -p bothThe following command runs the same query as the previous command but skips the name resolution step:portqry -n 192.168.1.20 -p both -nrThe following command queries the default TCP port of a web server:portqry -n www.widgets.microsoft.comSpecify one or more target portsThe following command tests the SMTP service of a mail server by querying TCP port 25:portqry -n mail.example.com -p tcp -e 25The following command queries TCP port 60897 and UDP port 60897 of a computer that has the IP address 192.168.1.20:portqry -n 192.168.1.20 -p both -e 60897The following command queries UDP ports 139, 1025, and 135 (in that sequence) on the computer "myServer":portqry -n myServer -p udp -o 139,1025,135The following command queries the range of ports from port 135 to port 139 (inclusive) on the computer "myServer":portqry -n myServer -p udp -r 135:139 Specify a log file for PortQry outputThe following command queries TCP port 143 on mail.widgets.microsoft.com, and records the output in the portqry.txt file. If the file already exists, PortQry overwrites it without prompting for confirmation.portqry -n mail.widgets.microsoft.com -p tcp -e 143 -l portqry.txt -y Query over a slow linkThe following command queries TCP ports 143, 110, and 25 on mail.widgets.microsoft.com. For each target port, PortQry waits twice as long as usual for a response. portqry -n mail.widgets.microsoft.com -p tcp -o 143,110,25 -slSpecify a source portThe following command uses UDP port 3001 (if it's available) on the local computer to send a query to UDP port 53 on 192.168.1.20. If a service is listening on that port and responds to the query, it sends the response to UDP port 3001 on the local computer.portqry -p udp -e 53 -sp 3001 -n 192.168.1.20The following command uses UDP port 3000 (if it's available) on the local computer to send a query to UDP port 389 on myDomainController.contoso.com. By default, the LDAP service should be listening on this port. If the LDAP service responds to the first query, PortQry uses an ephemeral source port to send the formatted query and receive any responses.portqry -n myDomainController.contoso.com -e 389 -sp 3000Use a batch file to run PortQry in quiet modeThe following text is an example of a batch file that runs PortQry in quiet mode::Topportqry -n 169.254.18.22 -e