PortQry

https://learn.microsoft.com/troubleshoot/windows-server/
Admin
PortQry is a command-line tool that helps troubleshoot TCP/IP connectivity issues by reporting the...
Tokens:11,417
Snippets:57
Trust Score:10
Update:3 weeks ago
Show doc for...
Tokens:
Raw
### PortQry interactive mode output

Source: https://learn.microsoft.com/troubleshoot/windows-server/networking/portqry-command-line-port-scanner-v2

Example output from starting PortQry in interactive mode. Shows the interactive prompt and default settings.

```output
Portqry Interactive Mode

Type 'help' for a list of commands

Default Node: 127.0.0.1

Current option values:  
   end port= 80  
   protocol= TCP  
   source port= 0 (ephemeral)
>

```

--------------------------------

### Start PortQry interactive mode with -i

Source: https://learn.microsoft.com/troubleshoot/windows-server/networking/portqry-command-line-port-scanner-v2

Starts PortQry in interactive mode. The output shows the interactive prompt with default node 127.0.0.1, end port 80, protocol TCP, and source port 0 (ephemeral).

```console
portqry -i

```

--------------------------------

### portqry -local output excerpt

Source: https://learn.microsoft.com/troubleshoot/windows-server/networking/portqry-command-line-port-scanner-v2

Example output from `portqry -local` showing active TCP/UDP ports, their local IP, state, and remote IP:port. Use this to verify local port usage.

```text
TCP/UDP Port Usage

96 active ports found

Port Local IPState Remote IP:Port  
TCP 80 0.0.0.0 LISTENING 0.0.0.0:18510  
TCP 80 169.254.149.9 TIME WAIT 169.254.74.55:3716  
TCP 80 169.254.149.9 TIME WAIT 169.254.200.222:3885  
TCP 135 0.0.0.0 LISTENING 0.0.0.0:10280  
UDP 135 0.0.0.0 :  
UDP 137 169.254.149.9 :  
UDP 138 169.254.149.9 :  
TCP 139 169.254.149.9 LISTENING 0.0.0.0:43065  
TCP 139 169.254.149.9 ESTABLISHED 169.254.4.253:4310  
TCP 139 169.254.149.9 ESTABLISHED 169.254.74.55:3714  

```

--------------------------------

### PortQry interactive mode DNS query output

Source: https://learn.microsoft.com/troubleshoot/windows-server/networking/portqry-command-line-port-scanner-v2

Example output after entering 'q dns' at the interactive mode command prompt to send a DNS query. Shows the service name resolution and the listening status of UDP port 53.

```output
resolving service name using local services file...
UDP port resolved to the 'domain' service

IP address resolved to myserver.contoso.com

querying...

UDP port 53 (domain service): LISTENING

>

```

--------------------------------

### PortQry interactive mode default node output

Source: https://learn.microsoft.com/troubleshoot/windows-server/networking/portqry-command-line-port-scanner-v2

Example output after entering 'n 10.0.1.10' at the interactive mode command prompt to set the default node to IP address 10.0.1.10.

```output
Default Node: 10.0.1.10

>

```

--------------------------------

### portqry -local restricted access output

Source: https://learn.microsoft.com/troubleshoot/windows-server/networking/portqry-command-line-port-scanner-v2

Example output from `portqry -local` when the security context lacks sufficient permissions. It shows a warning that restrictions may prevent access and recommends running as local administrator.

```text
Port and Module Information by Process

Note: restrictions applied to some processes may
prevent Portqry from accessing more information

For best results run Portqry in the context of
the local administrator

======================================================  
Process ID: 0 (System Idle Process)

PIDPortLocal IPState Remote IP:Port  
0TCP 4442 169.254.113.96 TIME WAIT 169.254.5.136:80  
0TCP 4456 169.254.113.96 TIME WAIT 169.254.5.44:445  

Port Statistics

TCP mappings: 2  
UDP mappings: 0

TCP ports in a TIME WAIT state: 2 = 100.00%

Could not access module information for this process

======================================================

```

--------------------------------

### PortQry log file output for PID monitoring

Source: https://learn.microsoft.com/troubleshoot/windows-server/networking/portqry-command-line-port-scanner-v2

Example log file output produced by the portqry -wpid command. Shows the command run, local computer name, watching PID, verbose output, service details, port mappings, and loaded modules.

```output
PortQry Version 2.0 Log File
  
System Date: <DateTime>
  
Command run:  
portqry -wpid 1276 -wt 2 -v -l pid.txt
  
Local computer name:
  
host123
  
Watching PID: 1276
  
Checking for changes every 2 seconds
  
verbose output requested
  
Service Name: DNS  
Display Name: DNS Server  
Service Type: runs in its own process

============
System Date: <DateTime>

======================================================

Process ID: 1276 (dns.exe)

Service Name: DNS
Display Name: DNS Server
Service Type: runs in its own process

PIDPortLocal IPState Remote IP:Port
1276TCP 53 0.0.0.0 LISTENING 0.0.0.0:2160
1276TCP 1087 0.0.0.0 LISTENING 0.0.0.0:37074
1276UDP 1086 0.0.0.0 :
1276UDP 2126 0.0.0.0 :
1276UDP 53 127.0.0.1 :
1276UDP 1085 127.0.0.1 :
1276UDP 53 169.254.11.96 :

Port Statistics

TCP mappings: 2
UDP mappings: 5

TCP ports in a LISTENING state: 2 = 100.00%

Loaded modules:
C:\WINDOWS\System32\dns.exe (0x01000000)
C:\WINDOWS\system32\ntdll.dll (0x77F40000)
C:\WINDOWS\system32\kernel32.dll (0x77E40000)
C:\WINDOWS\system32\msvcrt.dll (0x77BA0000)
C:\WINDOWS\system32\ADVAPI32.dll (0x77DA0000)
C:\WINDOWS\system32\RPCRT4.dll (0x77C50000)
C:\WINDOWS\System32\WS2_32.dll (0x71C00000)
C:\WINDOWS\System32\WS2HELP.dll (0x71BF0000)
C:\WINDOWS\system32\USER32.dll (0x77D00000)
C:\WINDOWS\system32\GDI32.dll (0x77C00000)
C:\WINDOWS\System32\NETAPI32.dll (0x71C40000)
```

--------------------------------

### Run PortQry in local mode

Source: https://learn.microsoft.com/troubleshoot/windows-server/networking/portqry-command-line-port-scanner-v2

Use this syntax to run PortQry in local mode on the computer where PortQry runs. The -local, -wport, and -wpid parameters are mutually exclusive; -wt cannot be used alone or with -local, and -q does not function in local mode.

```console
portqry -local | -wpid <pid> | -wport <port_number> [-wt <seconds>] [-l <filename.txt>] [-v]

```

--------------------------------

### PortQry command-line syntax

Source: https://learn.microsoft.com/troubleshoot/windows-server/networking/portqry-command-line-port-scanner-v2

Basic syntax for running PortQry in command-line mode. The -n parameter is required and specifies the IP address, computer name, or domain to query. Optional parameters can be added to the command string.

```console
portqry.exe -n <name_to_query> [options]

```

--------------------------------

### Batch file for quiet mode with log output

Source: https://learn.microsoft.com/troubleshoot/windows-server/networking/portqry-command-line-port-scanner-v2

Batch file that runs PortQry in quiet mode with -q, logging to pqlog.txt. The output shows the resulting log file content, including the command run and the LISTENING status for TCP port 443.

```console
:Top
portqry -n 169.254.18.22 -e 443 -nr -l pqlog.txt -q
:end
```

```output
PortQry Version 2.0 Log File

System Date: Thu Sep 16 10:35:03 2021

Command run:
 portqry -n 169.254.18.22 -e 443 -nr -l pqlog.txt -q

Local computer name:

 SOURCESERVER

Querying target system called:

 169.254.18.22

TCP port 443 (https service): LISTENING


========= end of log file ========= 
```

--------------------------------

### PortQry interactive query shortcut syntax

Source: https://learn.microsoft.com/troubleshoot/windows-server/networking/portqry-command-line-port-scanner-v2

Syntax for using query shortcuts in interactive mode. Replace <shortcut> with one of the shortcuts from the table (e.g., dns, ftp, imap). If omitted, queries TCP port 80.

```console
q <shortcut>

```

--------------------------------

### Set PortQry interactive mode option

Source: https://learn.microsoft.com/troubleshoot/windows-server/networking/portqry-command-line-port-scanner-v2

Use this syntax to set options in PortQry interactive mode, such as source port or slow link delay. Replace <option> with the option name and <value> with the new value.

```console
set <option>=<value>

```

--------------------------------

### Query TCP port 143 and log output to file

Source: https://learn.microsoft.com/troubleshoot/windows-server/networking/portqry-command-line-port-scanner-v2

Queries TCP port 143 on mail.widgets.microsoft.com and records output in portqry.txt. If the file already exists, PortQry overwrites it without prompting for confirmation.

```console
portqry -n mail.widgets.microsoft.com -p tcp -e 143 -l portqry.txt -y
```

--------------------------------

### Monitor a process ID with portqry -wpid

Source: https://learn.microsoft.com/troubleshoot/windows-server/networking/portqry-command-line-port-scanner-v2

Monitors a specific process by its PID, checking the status of ports it uses every two seconds until Esc is pressed. Creates the log file pid.txt, prompting to overwrite if it already exists, and records verbose output.

```console
portqry.exe -wpid 1276 -wt 2 -v -l pid.txt
```

--------------------------------

### Services file entries for LDAP port mapping

Source: https://learn.microsoft.com/troubleshoot/windows-server/networking/portqry-command-line-port-scanner-v2

Shows the default Services file entry for LDAP and the modified entry that forces PortQry to send LDAP queries to port 1025. Edit the Services file at %SYSTEMROOT%\System32\Drivers\Etc to change the port-to-service mapping.

```text
ldap              389/tcp                           #Lightweight Directory Access Protocol

```

```text
ldap              1025/tcp                           #Lightweight Directory Access Protocol

```

--------------------------------

### Specify a source port with -sp

Source: https://learn.microsoft.com/troubleshoot/windows-server/networking/portqry-command-line-port-scanner-v2

Sends a UDP query from local port 3001 to UDP port 53 on 192.168.1.20. If a service is listening and responds, the response is sent back to UDP port 3001.

```console
portqry -p udp -e 53 -sp 3001 -n 192.168.1.20
```

--------------------------------

### Query default TCP and UDP ports without name resolution

Source: https://learn.microsoft.com/troubleshoot/windows-server/networking/portqry-command-line-port-scanner-v2

Runs the same query as the previous command but skips the name resolution step using the -nr flag.

```console
portqry -n 192.168.1.20 -p both -nr
```

--------------------------------

### Query multiple UDP ports in sequence

Source: https://learn.microsoft.com/troubleshoot/windows-server/networking/portqry-command-line-port-scanner-v2

Queries UDP ports 139, 1025, and 135 in that sequence on the computer myServer.

```console
portqry -n myServer -p udp -o 139,1025,135
```

--------------------------------

### Query RPC port 135 with endpoint mapper output

Source: https://learn.microsoft.com/troubleshoot/windows-server/networking/portqry-command-line-port-scanner-v2

Queries UDP port 135 on myServer. PortQry first sends an unformatted datagram, reports LISTENING or FILTERED, then sends a formatted RPC query to the endpoint mapper. The output shows the endpoint mapper database response with UUIDs, protocols, addresses, and endpoints, and the final LISTENING status.

```console
portqry -n myServer -p udp -e 135
```

```output
UDP port 135 (epmap service): LISTENING or FILTERED  
Querying Endpoint Mapper Database...  
Server's response:  

UUID: 50abc2a4-574d-40b3-9d66-ee4fd5fba076
ncacn_ip_tcp:169.254.12.191[4144]

UUID: ecec0d70-a603-11d0-96b1-00a0c91ece30 NTDS Backup Interface
ncacn_np:\\MYSERVER[\PIPE\lsass]

UUID: e3514235-4b06-11d1-ab04-00c04fc2dcd2 MS NT Directory DRS Interface
ncacn_ip_tcp:169.254.12.191[1030]

UUID: e3514235-4b06-11d1-ab04-00c04fc2dcd2 MS NT Directory DRS Interface
ncadg_ip_udp:169.254.12.191[1032]

UUID: 12345678-1234-abcd-ef00-01234567cffb
ncacn_np:\\MYSERVER[\PIPE\lsass]

UUID: 12345678-1234-abcd-ef00-01234567cffb
ncacn_np:\\MYSERVER[\PIPE\POLICYAGENT]

Total endpoints found: 6

==== End of RPC Endpoint Mapper query response ====

UDP port 135 is LISTENING
```

--------------------------------

### Query default TCP and UDP ports by IP address

Source: https://learn.microsoft.com/troubleshoot/windows-server/networking/portqry-command-line-port-scanner-v2

Queries the default TCP and UDP ports of a computer specified by its IP address.

```console
portqry -n 192.168.1.20 -p both
```

--------------------------------

### Query LDAP port 389 with source port

Source: https://learn.microsoft.com/troubleshoot/windows-server/networking/portqry-command-line-port-scanner-v2

Sends a UDP query from local port 3000 to UDP port 389 on myDomainController.contoso.com. By default, the LDAP service should be listening on this port. If the LDAP service responds to the first query, PortQry uses an ephemeral source port for the formatted query and responses.

```console
portqry -n myDomainController.contoso.com -e 389 -sp 3000
```

--------------------------------

### Query default TCP port of a web server

Source: https://learn.microsoft.com/troubleshoot/windows-server/networking/portqry-command-line-port-scanner-v2

Queries the default TCP port of a web server.

```console
portqry -n www.widgets.microsoft.com
```

--------------------------------

### Query a range of UDP ports

Source: https://learn.microsoft.com/troubleshoot/windows-server/networking/portqry-command-line-port-scanner-v2

Queries the range of ports from port 135 to port 139 (inclusive) on the computer myServer.

```console
portqry -n myServer -p udp -r 135:139
```

--------------------------------

### Query default UDP port by computer name

Source: https://learn.microsoft.com/troubleshoot/windows-server/networking/portqry-command-line-port-scanner-v2

Queries the default UDP port on a computer specified by its computer name.

```console
portqry -n myServer -p udp
```

--------------------------------

### Query default TCP port by FQDN

Source: https://learn.microsoft.com/troubleshoot/windows-server/networking/portqry-command-line-port-scanner-v2

Queries the default TCP port on a computer specified by its fully qualified domain name (FQDN).

```console
portqry -n myDomainController.example.com -p tcp
```

--------------------------------

### Test SMTP service by querying TCP port 25

Source: https://learn.microsoft.com/troubleshoot/windows-server/networking/portqry-command-line-port-scanner-v2

Tests the SMTP service of a mail server by querying TCP port 25.

```console
portqry -n mail.example.com -p tcp -e 25
```

--------------------------------

### Query TCP ports over a slow link

Source: https://learn.microsoft.com/troubleshoot/windows-server/networking/portqry-command-line-port-scanner-v2

Queries TCP ports 143, 110, and 25 on mail.widgets.microsoft.com. For each target port, PortQry waits twice as long as usual for a response using the -sl flag.

```console
  portqry -n mail.widgets.microsoft.com -p tcp -o 143,110,25 -sl
```

--------------------------------

### Query TCP and UDP port 60897

Source: https://learn.microsoft.com/troubleshoot/windows-server/networking/portqry-command-line-port-scanner-v2

Queries TCP port 60897 and UDP port 60897 of a computer with IP address 192.168.1.20.

```console
portqry -n 192.168.1.20 -p both -e 60897
```
Tokens:
Raw