question

gabrielsztejnworcel-3009 avatar image
0 Votes"
gabrielsztejnworcel-3009 asked TG-5895 published

Listening port is being replaced automatically by some random port

Hi,

We are having a strange problem in one of our customers' environment: We are running a program that opens a TCP listener and listens for incoming connections from another process running on the same machine. The port which the program should listen on is passed as an argument. The program seems to be working, but it doesn't listen on the expected port - when checking using netstat or tcpview we that it listens on some random port, this of course means we can't communicate with the program on the expected port. From tests we ran it's always between 22000 and 22200, but the actual port seems to be random.

The first thing I thought of was the program itself, so I tried to use a simple Powershell script that opens a port and listens, but the behavior is the same, the port is replaced. We tried listening on different ports: 10000, 20000, ..., 60000 but it is always replaced. We also verified that the requested ports are not in use (although if that was the problem, it would just throw an error rather than changing the port number). We asked the customer to disable any antivirus or additional software they have running on the machine but it didn't help. I also checked using Procmon to see if any unknown DLL is loaded into process, but I didn't find anything.

Does anyone have an idea of what can cause this behavior or an idea for anything else I can check?

Thanks,
Gabriel

windows-server-2012
· 9
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Hi,
Would you mind letting me know the update of the problem?

0 Votes 0 ·

Hi,
The program still exists.
I was asked about the specific program here - my first thought was also the program itself, so we tried to write a simple Powershell script that opens a TCP listener on some requested port, and we see the same behavior - you ask to listen on port 6000 for example, the script runs and everything looks OK, but when you check using netstat or tcpview you see that the program actually listens on a totally different port - 22041 in this specific case but it varies.
Thanks

0 Votes 0 ·
DSPatrick avatar image DSPatrick gabrielsztejnworcel-3009 ·

I was asked about the specific program here

What program?






0 Votes 0 ·
Show more comments

Hi,
We have exactly the same issue on a windows server 2019. Did you find something to resolve this issue ?

Thanks,
Ahmed

0 Votes 0 ·

Hi,

Unfortunately not.

Thanks,
Gabriel

0 Votes 0 ·

Your server has the RDS role ? And this server is configured in a RDS FARM ?

0 Votes 0 ·
Show more comments
DSPatrick avatar image
0 Votes"
DSPatrick answered gabrielsztejnworcel-3009 commented

but it doesn't listen on the expected port

You'll need to raise the issue with the application developer, windows does not control this behavior.


--please don't forget to Accept as answer if the reply is helpful--








· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

It's not caused by the program because the same thing happens with a simple Powershell I wrote that opens a TCP listener.

0 Votes 0 ·
GloriaGu-MSFT avatar image
0 Votes"
GloriaGu-MSFT answered MotoX80 commented

@gabrielsztejnworcel-3009 Hi,

Thank you for posting in Q&A!

May I ask what specific program caused this issue? Is it a application developed by microsoft? If it's a third- party application, it is suggested that you can refer to the corresponding team for more professional support, thank you for your understanding!


Hope you have a nice day!
Gloria

============================================
If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
https://docs.microsoft.com/en-us/answers/articles/67444/email-notifications.html

· 2
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

The program is called vcxsrc, it's not developed by Microsoft, but the issue is not caused by the program itself because the same thing happens with a simple Powershell I wrote that opens a TCP listener.

0 Votes 0 ·
MotoX80 avatar image MotoX80 gabrielsztejnworcel-3009 ·

Can you post the script so that others can test it on their systems?

0 Votes 0 ·
TG-5895 avatar image
0 Votes"
TG-5895 answered TG-5895 published

We had this exact same issue; For us, an agent for Palo Altos UserID product was the culprit. Stop/Starting the Palo agent we could get desired behaviour/reproduce problem.

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.