Does svchost.exe (Windows Service Host Process) use ephemeral ports?

Question

When running an application that utilizes a fixed port number, we encountered the error "Address already in use."

Upon investigation, it was determined that the port number defined by the application was ephemeral.

We are in the process of changing it. However, for precautionary measures, we would like to confirm whether "svchost.exe" is also using ports other than ephemeral ports.

Answer 1

Hello

Thank you for posting in Microsoft Community forum.

The svchost.exe process in Windows is a generic host process name for services that run from dynamic-link libraries (DLLs). It can use both well-known ports (0-1023), registered ports (1024-49151), and dynamic or private ports (49152-65535) depending on the service it’s hosting.

To identify what ports are being used by a particular process, you can use the NETSTAT.EXE and TASKLIST.EXE utilities provided with the operating system. The NETSTAT.EXE command can be used to identify what ports are being used by a particular process. The syntax for NETSTAT.EXE is as follows: netstat.exe –a –n –o.

If the process that you are looking at is an instance of SVCHOST.EXE, then you will need to use slightly different switches for TASKLIST.EXE. This will allow you to see exactly what services are running in that instance of SVCHOST.EXE.

Please note that many services running over svchost.exe use TCP/IP ports (sockets) for inter-process communication over localhost. Therefore, it’s possible that svchost.exe could be using the port your application is trying to use.

What Port is that Service using? - Microsoft Community Hub

Best Regards,

Wesley Li