You work as a Network Administrator for InformSec Inc. You find that the TCP port number 23476 is open on your server. You suspect that there may be a Trojan named Donald Dick installed on your server

Tripwire is a file integrity monitoring tool that detects unauthorized changes to files - it does not map network ports to running processes.

SubSeven (Sub7) is itself a remote access Trojan, not a diagnostic or security analysis utility.

Netstat displays active network connections and listening ports but does not provide the full executable path of the owning process, making it insufficient for confirming the Trojan's file location.

Fport, developed by Foundstone, is specifically designed to enumerate all open TCP and UDP ports and correlate each one to the owning process, reporting the process name, process ID (PID), and the full file system path of the executable. This makes it the ideal tool for investigating a suspicious port like 23476 and confirming whether a specific Trojan binary is responsible. Its output directly answers the investigator's need to link a port number to a specific process and its location on disk.