Gfrktyl

I have a similar problem as the one discussed in this thread Why is System listening on port 8000? and the solution given there did not help me, so I am raising a new issue!

I am using Virtual DJ SW, which has the feature to broadcast live a session (it creates an mp3 file that can be streamed by other users). However, when I try to broadcast, Virtual DJ gives an error message: "* Broadcast error * Cannot listen to port 8000".

The usual solution is: to set up port forwarding (I am on a wireless connection via a router). I know how to set up port forwarding, and after some time getting used to this particular router - I was able to set up the port forwarding correctly. However, the problem remained (I received the error message from the Virutal DJ SW when I tried broadcasting)!

Investigating the problem further, I found several resources to check whether ports are open. If I check the port on http://www.yougetsignal.com/tools/open-ports/ - it shows as open! I also downloaded PFPortChecker and this is where the fun started:
- for UDP the port 8000 is open according to PFPortChecker
- for TCP it says that it cannot check it for, as a program has it locked.

Investigating further, I've checked netstat -aon, which gives
TCP 0.0.0.0:8000 0.0.0.0 LISTENING 4 (as the PID)
and in TaskManager PID 4 stands for System (NT Kernel & System).

At this point I located the thread mentioned in the first paragraph, however for the several solutions given there, I either don't understood them or they don't work:

• solution 1: something related to HTTP Server API - did not understand what I need to do. One aswer was "The HTTP response of the server lists Microsoft-HTTPAPI/2.0 as the server." I've got no idea how I could get a HTTP response of the server...




• solution 2: could not be trojans, as I'm running a weekly Avira check on my computer, and every now and then I check it with anti malware




• solution 3: adding NoRun to HTTP via regedit - did not work




• solution 4: different command in command prompt (netstat -ab): shows the port 8000 as LISTENING with info: "can not obtain ownership information" - is this the thing to investigate? How?

What can I do?

EDIT: problem solved - from the other end. I somehow randomly stumbled upon a possibility to change the port that Virtual DJ broadcasts through (there were no such an option per se, but changing some option for a function that I don't use I was able to change the port from 8000 to something else - before that I thought that it has 8000 hard-coded as the only option). So the new port after forwarding works fine, and I don't need 8000 any more. But still would be interested to know why it is blocked by system, especially as it seems that for other users the same thing blocks other ports (namely 80). Why 8000 for me?

If the port is being held open by the System Process (PID 4), then there's some software on your system using the Kernel's Web Server http.sys API. You can try opening a web browser and entering http://127.0.0.1:8000 into the address bar and see if a webpage loads up. If you're lucky, something will and will give you a clue as to what's using it. Otherwise you'll have to go through your running programs 1 by 1 until you find the culprit. Start with non-Microsoft software -- they generally doesn't pick such popular ports for their own services by default.

I use TCPView to see what is listening on a port and note the PID of the process. Then I use Process Explorer to see what that is in more detail.

Microsoft TechNet, System Internals TCPView and Process Explorer

Run process explorer as administrator to get details on system processes and double click a process to get command line and other details (Image tab in properties dialog).

In my case, port 8000 was taken over by drivers for Sound BlasterX AE-5 sound card. Process Creative.AudPosService located in C:Program Files (x86)CreativeConnection Service has been using this port.

Luckily, it is possible to change this port. Open Creative.AudPosService.exe.config and change line where port number is located <add baseAddress="http://localhost:8000/"/> to <add baseAddress="http://localhost:9999/"/> or anything else that don't interfere with your work.