nerdexam
GIAC

GCFA · Question #84

Nathan works as a professional Ethical Hacker. He wants to see all open TCP/IP and UDP ports of his computer. Nathan uses the netstat command for this purpose but he is still unable to map open…

The correct answer is D. fport. The fport utility maps all open TCP/IP and UDP ports to their owning processes, providing the PID, process name, and executable path that netstat alone cannot show.

Advanced Incident Response & Digital Forensics Fundamentals

Question

Nathan works as a professional Ethical Hacker. He wants to see all open TCP/IP and UDP ports of his computer. Nathan uses the netstat command for this purpose but he is still unable to map open ports to the running process with PID, process name, and path. Which of the following commands will Nathan use to accomplish the task?

Options

  • Aping
  • BPsloggedon
  • CPslist
  • Dfport

How the community answered

(42 responses)
  • A
    14% (6)
  • B
    7% (3)
  • C
    5% (2)
  • D
    74% (31)

Why each option

The fport utility maps all open TCP/IP and UDP ports to their owning processes, providing the PID, process name, and executable path that netstat alone cannot show.

Aping

Ping sends ICMP echo requests to test host reachability and round-trip time - it provides no information about open ports or running processes.

BPsloggedon

Psloggedon is a Sysinternals tool that displays which users are currently logged on locally or via resource shares - it does not enumerate open network ports or map them to processes.

CPslist

Pslist is a Sysinternals tool that lists running processes and their resource usage statistics - it shows process details but does not map those processes to open network ports.

DfportCorrect

Fport, developed by Foundstone, is a command-line tool that enumerates all active TCP and UDP ports on a Windows system and correlates each port to the process that owns it, including the PID, process name, and full path to the executable - exactly filling the gap left by the standard netstat command.

Concept tested: Port-to-process mapping using fport utility

Source: https://learn.microsoft.com/en-us/sysinternals/downloads/tcpview

Topics

#fport#netstat#open ports#process-to-port mapping

Community Discussion

No community discussion yet for this question.

Full GCFA Practice