TCPView is a great little utility that keeps it simple and does its job well. Since there's no install, removing the program is as simple as deleting the files or directory you placed them in. The download comes as a ZIP file with no installer, and there are two executable files in the ZIP, which may be a tad confusing.

We couldn't get the included Help file to load, but the program itself seemed quite stable. You can also save the entire list to a text file, and alter the speed at which the list refreshes. If there's a lot of activity on your system, you can filter the list. If a particular program-or perhaps malevolent bit of spyware-is streaming data from your system, you'll be able to see it, and, with the handy context menus, either close the connection or end the process. The list auto-updates as connections are created or destroyed, so you can see your network activity in real-time. You get a list of the TCP/UDP connections on your system, and the ability to interact with specific connections or the process that created them. TCPView presents you with a very simple interface that is appropriate to its purpose and relatively easy to use. Finally use 'process explorer' to track and locate the services you found with TCPView.If something on your system is running amok, or you think you might have a spy in your midst, or you're simply curious (or obsessive) about the inner workings of your network, give this simple program a look. Start with 'TCPView' to see any hidden services and the ports associated with them. This may not be the source of your ICMP traffic, further investigation is needed.Īnyhow, as I said before I would capture some traffic on that LAN segment to analyse exactly what the traffic is and which ports its using.Īfter capturing and analysing some traffic, run some of Mark Russinovich's tools on any of the Windows boxes to see what process are generating the traffic, see His tools are free and arguably some of the best, most elegantly written available for debugging/analysis of Win32 systems. tcpshow reads a tcpdump(1) savefile and provides a reasonably complete decode of Ethernet, IP, ICMP, UDP and TCP headers. However it is often a target for remote DDoS attacks and remote penetration as many Windows services use the port mapper for connections.Its good practice to block RPC scans at your nwtork perimter(port 135). It's a legitimate service that all Windows OS's run and its not a virus.

Epmap is the Microsoft RPC endpoint mapper (port 135).

Tcpview icmp