Find process using port 80

Question

I have a Windows service that listens on port 80 using OWIN self hosting (WebApp.Start). I want to find that service programmatically using a PowerShell script. I have the following PowerShell script:

netstat -noab | Select-String ":80 " -Context(1,0) `
 | Where { $_.Context.PreContext[0].Trim().StartsWith("[") } `
 | ForEach { ($_.Context.PreContext[0].Substring(2) -split ']')[0] }

However this only yields lsass.exe.

If I run netstat -noa, I get some more results, but all the processes listed are system processes (not mine) or have "Can not obtain ownership information" when I include the -b option

  TCP    0.0.0.0:80             0.0.0.0:0              LISTENING       4
  TCP    10.100.18.158:80       10.100.25.102:42967    ESTABLISHED     4
  TCP    10.100.18.158:80       10.100.25.102:42968    ESTABLISHED     4
  TCP    10.100.18.158:80       10.100.25.102:42974    ESTABLISHED     4
  TCP    10.100.18.158:80       10.100.28.8:44763      ESTABLISHED     4
  TCP    10.100.18.158:80       10.100.28.8:44764      ESTABLISHED     4
  TCP    10.100.18.158:80       10.100.28.8:44765      ESTABLISHED     4
  TCP    10.100.18.158:80       10.100.28.8:47400      ESTABLISHED     4
  TCP    [::]:80                [::]:0                 LISTENING       4

I recognize that this is probably because of the way OWIN uses the HTTP listener internally.

Any way to reliably determine the process/service using the port?

Answer 1

Usually that is a sign that it is HTTP.sys,

I answered something similar here: Cannot bind to port 80, Microsoft-HTTPAPI/2.0 Lock

but summary is that you can use The best way to figure out why that is the case is to run the following command from an elevated command prompt, and it will list all registrations including the Process IDs using them:

    netsh http show servicestate view=requestq verbose=yes

Request queue name: Request queue is unnamed.
    Version: 2.0
    State: Active
    Request queue 503 verbosity level: Basic
    Max requests: 1000
    Number of active processes attached: 1
    **Process IDs**:
        1120
    URL groups:...

and find in there the right reservation, something maybe like: HTTP : // LOCALHOST:80/ or LOCALHOST:80, or *:80

IIS will register the reservation with the Request queue name using the Application Pool name which let you figure out easily who is using it.