48

(Windows 7 x86)

If I run netstat -ab, I get a list of active connections, along with the names of the applications which have opened the connections.

However, some connections (including the one opened by my app) are listed as:

Can not obtain ownership information

Why?

Thanks,

Darren.

Tombart
  • 26,066
  • 13
  • 112
  • 120
dbruning
  • 4,587
  • 5
  • 31
  • 33

4 Answers4

52

Run netstat -ano and look at the PID that it is under.

Colin Bowern
  • 2,002
  • 1
  • 17
  • 33
  • 1
    FWIW, wrote a batch script to parse netstat output and concatenate all info from each connection to one line: http://stackoverflow.com/a/26839729/1569434 – Lizz Dec 13 '14 at 09:41
39

If you add the '-o' option, you'll see the PID values, and likely it will be PID 4, which is the System PID. This means it is probably a Service. (Note that Windows 7 will report "PID 4", while Windows XP will report "System").

This link gives some ideas of what it might be: https://superuser.com/questions/43307/whys-is-system-process-listening-on-port-80?rq=1

Community
  • 1
  • 1
Mark Lakata
  • 18,024
  • 5
  • 88
  • 112
  • Noted difference from previous Windows versions done by design according to [this](http://social.technet.microsoft.com/Forums/en-US/winservergen/thread/1f7299da-bbb9-4b3f-8df7-2c09ed8bd44c/) – Monso Feb 25 '13 at 22:26
  • 1
    Also, this http://stackoverflow.com/questions/1430141/port-80-is-being-used-by-system-pid-4-what-is-that – Dan Mar 04 '14 at 12:08
2

It's probably NETBIOS, if the port used is 137, 138, or 139. On my Win7 system, disabling NETBIOS on all my network adapters from the Network and Sharing Center made the connections disappear from netstat.

I'm posting this as a new answer because the other questions linked above are protected, and I can't reply to those answers as a guest. Hopefully this will help people like me who stumble onto this question.

user5979788
  • 21
  • 1
1

Just went through this lately, just to add to the answers already. Running a .NET webserver, it often happens with incoming web connections. They seem to get PID 0 (System Idle) which is just a holding place for connections. It says "Can not obtain ownership information" for these.

Good description of why its on PID 0, TCP connection owned by pid zero

Community
  • 1
  • 1
Keith Nicholas
  • 41,161
  • 15
  • 82
  • 145