Listening port is being replaced automatically by some random port

Question

Hi,

We are having a strange problem in one of our customers' environment: We are running a program that opens a TCP listener and listens for incoming connections from another process running on the same machine. The port which the program should listen on is passed as an argument. The program seems to be working, but it doesn't listen on the expected port - when checking using netstat or tcpview we that it listens on some random port, this of course means we can't communicate with the program on the expected port. From tests we ran it's always between 22000 and 22200, but the actual port seems to be random.

The first thing I thought of was the program itself, so I tried to use a simple Powershell script that opens a port and listens, but the behavior is the same, the port is replaced. We tried listening on different ports: 10000, 20000, ..., 60000 but it is always replaced. We also verified that the requested ports are not in use (although if that was the problem, it would just throw an error rather than changing the port number). We asked the customer to disable any antivirus or additional software they have running on the machine but it didn't help. I also checked using Procmon to see if any unknown DLL is loaded into process, but I didn't find anything.

Does anyone have an idea of what can cause this behavior or an idea for anything else I can check?

Thanks,
Gabriel

Answer 1

but it doesn't listen on the expected port

You'll need to raise the issue with the application developer, windows does not control this behavior.

--please don't forget to Accept as answer if the reply is helpful--

Answer 2

@gabriel sztejnworcel Hi,

Thank you for posting in Q&A!

May I ask what specific program caused this issue? Is it a application developed by microsoft? If it's a third- party application, it is suggested that you can refer to the corresponding team for more professional support, thank you for your understanding!

Hope you have a nice day!
Gloria

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
https://learn.microsoft.com/en-us/answers/articles/67444/email-notifications.html

Answer 3

We had this exact same issue; For us, an agent for Palo Altos UserID product was the culprit. Stop/Starting the Palo agent we could get desired behaviour/reproduce problem.