Welcome to Port Explorer!

Welcome to DiamondCS Port Explorer
The leading port-to-process viewer for Windows

Do you know who is connected to your computer?
... if any of your personal data is being sent out to the Internet?
... which process is using a particular port?
... if any programs on your computer are listening, waiting for somebody to connect?
... which programs on your computer are running as invisible servers (possibly trojans)?
... which programs on your computer transmit information to the Internet without you knowing?
 If you answered no to any of these questions, don't worry - Port Explorer can answer them all.

What is Port Explorer?
Port Explorer is an advanced state-of-the-art socket analysis and exploration utility that allows you to immediately see exactly which programs on your computer are using the Internet. For a long time now Port Explorer has been generally accepted as being the leading program of its kind, and is the only port-to-process mapper available for Windows 95/98/ME, yet its intuitive interface makes it easy for both novice users and experts alike.

Multi-Language Support
The following languages are fully supported:
Dutch, French, English, German, Italian, Portuguese, Spanish, Swedish

A screenshot of Port Explorer in action...
An actual screencapture of the main Port Explorer window. The red sockets belong to a trojan called NetBus and are highlighted red by Port Explorer because the program is invisible.

While some socket analysis programs simply aim to give you a slightly better view of your sockets than the netstat console program, Port Explorer is like no other and takes socket analysis and control to the highest level, giving you many advanced features not available in any other programs. Some of these features include:

  • Port-to-process mapping allowing you to easily see which programs are using which ports/sockets.
  • IP-to-country resolving allowing you to easily see which country an IP address belongs to.
  • Hidden server detection allowing you to easily see invisible programs that use sockets - a method that generically detects virtually all known remote access trojans.
  • Packet-sniffing allowing you to spy on, record and analyse the transmissions sent/received by sockets and processes.
  • Process termination with advanced Windows SeDebugPrivilege allowing you to terminate any Win32 process.
  • Socket termination allowing you to close individual sockets without affecting the parent process or other sockets.
  • Socket send/receive blocking allows you to prevent individual sockets from sending and/or receiving data.
  • Real-time activity watching
  • Traffic volume reporting allows you to see how many bytes and packets have been sent and received by individual sockets.
  • Socket creation reporting allows you to see when individual sockets were created.
  • Network utilities built-in allow you to Ping, Resolve, Traceroute, Whois, and view Statistics.
  • Whois search client with powerful fully-automatic and manual search options rivals standalone Whois clients in performance and results.
  • Advanced sorting with moveable and sortable columns and tabs allows you to analyse and filter on-screen data quickly and easily.
  • Internal databases allow you to cross-search ports and services, countries and domain codes.
  • World map allows you to see the geographic locations of resolved countries.
  • Multi-language support allows you to switch languages on the fly.
  • Configurable interface allowing you to give the program the exact look and feel you want.
  • Comprehensive documentation that is easy to understand allows you to quickly find the answer to virtually every question you'll ever have about Port Explorer.
  • Members area allows you to get instant support and answers when you need it, plus access to special members-only downloads.
  • Network Administrators will save time and effort in isolating, analysing and fixing network-related problems

Port Explorer has been designed for maximum efficiency to use as few resources and as little memory as possible. It doesn't require any 3rd-party files, can be used at resolutions as low as 640x480 @ 256-color, is efficient enough to run on slow 486 processors, and is small enough to fit onto a single floppy disk. Port Explorer has been thoroughly tested in real-world international conditions and is compatible with the following Microsoft® operating systems - more than any other program of its kind:

  • Windows 95
  • Windows 95 OSR2
  • Windows 98
  • Windows 98 SE
  • Windows ME
  • Windows NT4 (SP4 or later)
  • Windows 2000
  • Windows 2000 Server
  • Windows 2003 Server
  • Windows XP

For best results we recommend Windows 2K/XP. Please see Operating System Specific Notes for more information. Port Explorer will not run under Windows 3.x (or earlier), Windows NT 3.x, or Windows NT 4 prior to Service Pack 4.

Copyright © 2002-2004 Diamond Computer Systems Pty. Ltd. - http://www.diamondcs.com.au
DiamondCS Port Explorer Website - http://www.diamondcs.com.au/portexplorer


Useful Links

Introduction for Beginners

When you send somebody a letter through the post, you must know two things - which address to send it to, and which person to send it to (as there may be more than one person living at that one address). The Internet is no different! When your computer is connected to a network (as it is when you are connected to the Internet), your computer has its own unique address - no two computers in the network can have the same address. In the case of the Internet, your computer will have its own Internet Protocol (IP) address, which may look something like 12.152.31.20 (four digits in the range of 0-255, each separated by a period). The IP address of your computer can be considered the same as the postal address for your house - it is the location people send data to when they want it delivered to you. To see your real, current IP address, click here: http://www.diamondcs.com.au/ipaddress.php

However, there's often more than one person living in one house, so postal letters aren't just addressed to the home address - they're also addressed to an individual person. In the case of your computer, there are usually several programs that are listening for data. In the case of the Internet, data is sent not just to an address, but also to an individual port. Only one program can listen on any one port. For example, if a web server is listening on port 80, no other programs can listen on that port while the web server is using it. If data is sent to port 80, the web server listening on port 80 then receives the data.

If Alice wishes to connect to Bob's computer, she needs to know the address of Bob's computer. Once she knows Bob's address she can try to connect a program on her computer to a program on Bob's computer. To do this, Alice must know which port to connect to. For example, if Bob has a program listening on port 100, then Alice needs to configure her program so that it connects to Bob's computer on port 100. Fortunately, finding the port to use is rarely an issue - most servers use static ports. For example, web servers nearly always listen on port 80, so if Alice is using a web browser (such as Internet Explorer), her software automatically knows to connect on port 80.

Port Explorer allows you to see all the connections and ports on your system, including which processes are using which ports, and which remote computers are connected to your system. It allows you to close established connections, gives you the ability to prevent a process or socket from sending and/or receiving data, and even allows you to spy on the data being sent and received.

Handy Tips:
Not sure what a technical word means? Try the Glossary
Looking for keyboard shortcuts (hotkeys)? Try Keyboard Shortcuts
Need personal help from other Port Explorer users? Try the Forum
Need technical support from DiamondCS? Email us
 Looking for other interesting things Port Explorer can do? Try Tips & Tricks!

Copyright © 2002-2003 Diamond Computer Systems Pty. Ltd. - http://www.diamondcs.com.au


Useful Links

What's New in Port Explorer

v2.000 September 02, 2004

  • Demo and full version are now the same version. You simply unlock the demo version with a serial key.
  • Windows 2003 and Windows XP SP2 support added and fully tested.
  • Added KILOBYTES/second information for each socket in the display. Allowing you to see the speeds each socket on your system is sending and receiving.
  • Added another fix to socket spy when closing the window when it is minimized
  • Updated country database (30% bigger), should now cover even more countries.
  • Reduced memory impact of Port Explorer on your system, in some cases a 20 fold decrease in physical memory utilization.
  • Added ability to show either local and/or remote traffic in the window log.
  • Added better IPv6 socket detection in the main list and in socket spy.
  • Fixed bug in WHOIS utility when the whois server returned too much data.
  • Hundreds of minor bug fixes and tweaks to increase usability, stability and reliability of Port Explorer.

v1.800 September 12, 2003

  • Now fully compatible with Windows 2003.
  • Many dialogs will now auto-close and reopen when you want to view information about another process/socket.
  • Process List utility added, with added ability to use it in conjuction with socket spy.
  • The Process Viewer window now also shows the full commandline (NT/2K/XP/2003 systems), using the same trick that the DiamondCS CmdLine utility uses.
  • Socket Spy data format changed to be faster and make the capture.bin file more compact.
  • Bug fixed in Socket Spy when corrupted headers are detected.
  • Socket Spy now remembers column widths and orders.
  • Added optional path for the logfile in registry (read helpfile "Tips and Tricks" for more details).
  • Fixed a rare bug that was caused by looping parent and child processes.
  • Lots of misc. small additions, tweaks and speedups.

v1.700 June 12, 2003

  • Fixed a problem to do with the program K9 which reported the incorrect proxy settings in the window log due to the methods used by K9.
  • Fixed a GUI issue when the user had fonts that were larger or smaller than normal.
  • Enhanced the DLL, several speed and performance improvements.
  • Various tweaks and small bug fixes.

v1.680 June 03, 2003

  • Added automatic IP-to-Country resolving of all remote IP addresses (there is now a Country column in the main display, file log, and window log).
  • Added IP-to-Country capability to the Lookup utility.
  • Resolve Utility now uses the IP database to locate countries (more accurate than the previous method).
  • Fixed a possible lockup which could occur on 2K/XP machines with process resolving.
  • Fixed a possible lockup during shutdown.
  • Fixed a possible crash in Lookup dialog when searching for items not in the database.
  • New evaluation version has more features enabled, including the Socket Spy packet-sniffer.
  • Each resolve thread now has its own controller.
  • More tweaks to the GUI.

v1.620 May 16, 2003

  • Added new Bandwidth Throttling feature for sockets and processes allowing you to restrict how much data is sent per second.
  • Increased speed of Ping and Traceroute, also making traceroute display more information.
  • Recoded address resolving, making it faster and more accurate, also reduced memory used and thread count.
  • Reduced time taken to properly close down Port Explorer.
  • Reduced disk access everytime a socket was updated which helps when running with other programs and overall CPU usage.
  • Trojan Detection improved and now uses even less CPU.
  • Allowed icon imagelist to reduce its size saving memory.
  • Fixed resolving threads not returning a small amount of memory on exit.
  • Made all threads have less stack space decreasing memory usage a bit.
  • Fixed a case where some NETSTAT sockets were incorrectly stating they were being spied upon or blocked.
  • EXE size reduced considerably (around 50KB) due to some pruning of resources.
  • Lots of cleanups and small tweaks

v1.600 April 5, 2003

  • Fixed SocketSpy window saving its position incorrectly when minimized.
  • Fixed rare bug in DLL with apps that use socket functions overlapping with closesocket().
  • Fixed a possible bug in which memory for a socket may not be released.
  • Fixed small issue in resolve utility with displaying very large hostnames.
  • Added more states for status of sockets.
  • Stopped a DLL being used by Port Explorer when on operating systems other than Windows 95, decreasing memory usage on all other Operating Systems.

v1.510 March 10, 2003

  • Fixed a rare issue with Clear Window Log.
  • Various language updates.

 v1.500 March 6, 2003

  • Added new traffic logging capability (logs to both window and file).
  • New easy-to-use packet viewer for Socket Spy with a hex-editor influence.
  • Socket Spy remembers window size and position, and is now fully resizable.
  • Whois Utility improved and more servers added.
  • Optimisations to Port Explorer and the LSP DLL to further reduce resource use.
  • Memory interface redesigned.
  • Italian language added.
  • Commandline parameter '-m' added for automatic minimise-to-tray on startup.
  • Improved performance (stress-tested in a 100mb/sec Local Area Network).
  • Lots of minor fixes.

v1.4x February 2003

  • Private beta team releases.

v1.350 January 9, 2003

  • Some Windows XP users reported 'menu blackening'. This was caused by Windows XP stealing the menu brush handle, but we've developed a workaround.
  • Added UDP remote address and remote port information (you can now see DNS lookups and other UDP-based IP addresses).
  • Fixed a rare problem where in some circumstances people were unable to run the EXE due to a strange issue in the anti-debug routines.
  • "System" socket detection is now more reliable, fixing problems some people had where all sockets appeared as system ones.
  • The closing-down dialog now hides the main window, and also fixed a possible problem that may occur if the user clicked Exit twice in quick succession.
  • Fixed packets and bytes sent/received being incorrect in rare cases.
  • Added "double-click" to the main display to show properties of the selected process.
  • German translation added.
  • Updates to helpfile - translators section updated, OS Specific Notes updated, and this page added.


Installer

This document declares and documents every file and registry setting that is added to your computer during installation and when running Port Explorer. Like you, we believe you have every right to know exactly what gets put on your computer when you install a program.

The Port Explorer Installer program has been carefully designed to make Install and Uninstall as seamless, easy, convenient and hassle-free as possible, yet still giving you complete control over install options. We have also been very careful to ensure that no files or registry settings related to Port Explorer are left behind should you choose to uninstall, keeping the install and uninstall as clean as possible.

Files that get installed
systempath = Windows\System directory under Win95/98, Windows\System32 under NT/2K/XP/2003.
apppath = Path where Port Explorer is installed (Program Files\Port Explorer by default)

systempath\dcsws2.dll | DiamondCS TCP/IP Layer - the heart of Port Explorer
systempath\sporder.dll | Required by dcsws2.dll during Port Explorer installation process
apppath\DiamondCS Website.url | Shortcut to the DiamondCS website
apppath\domains.dat | Domains and Countries database
apppath\license.txt | License agreement
apppath\pehelp.chm | This help manual
apppath\Port Explorer Website.url | Shortcut to the Port Explorer website
apppath\portexplorer.exe | The actual Port Explorer program
apppath\ports.dat | Ports and Services database

apppath\capture.bin is created during packet-capturing sessions. Its format is documented for programmers here.
Registered users require their unlock code to ensure they are running the full version.

No other files are used or created by Port Explorer, although users may wish to save their socket table listings to the Port Explorer directory if they use the File | Save Table menu item.

Registry keys that get installed
Port Explorer doesn't require any registry keys to be present in order to load. However, all Port Explorer configurable settings are saved to the registry in one convenient location, which are read during load if they exist:
HKEY_LOCAL_MACHINE\Software\Diamond Computer Systems\Port Explorer\


Remote Installation

The Port Explorer Installer program supports remote installation by providing Silent Installation command-line switches.

For mass rollout remote installations, Network Administrators will find these flags highly useful. The available switches are:

 /SILENT install all files with no prompts. Note that this will not reboot the machine.
 /VERYSILENT install all files with no prompts, and reboot after installation.
 /SP- the installer will proceed without asking "Do you wish to install DiamondCS Port Explorer?"

For example, you might run Port Explorer setup like this: setup.exe /VERYSILENT /SP-
This will install Port Explorer and reboot the system without any prompts. Note that default options are used, so Port Explorer will automatically be installed into the Program Files\Port Explorer directory. This directory can be moved/renamed, but associated shortcuts will need to be re-mapped.

As all Port Explorer configuration settings are stored in the registry (HKEY_LOCAL_MACHINE\Software\Diamond Computer Systems\Port Explorer\), it is relatively easy to create a custom .reg file that can be executed on remote computers to pre-configure them. To create a .reg file, simply use the Export feature in the regedit.exe utility that comes with all versions of Windows.

Important: The unlock code used to turn the demo version of Port Explorer into the full version is stored in the registry. For mass installation of Port Explorer you should copy this value (found in the Port Explorer registry key) or all values in the Port Explorer registry key, to the target machine also. This means the end-user won't need to enter any unlock code.


Uninstall

We've paid careful attention to the uninstall program to ensure that it removes everything the installation program installed, but without removing anything it shouldn't. The result is an uninstall program that leaves the system in exactly the same way it was before the install - just how every uninstall program should behave.

You can activate the uninstall procedure from either of three ways:
1. Press the Start button in Windows, then Programs | Port Explorer, then select Uninstall
or
 2. Press the Start button in Windows, then Settings | Control Panel | Add/Remove Programs, then select DiamondCS Port Explorer.
or
3. Press the Start button in Windows, then Run, select Browse to find your Port Explorer install directory, double-click on unins000.exe, and press OK.

Uninstall deletes all files that were installed during the install process, and offers you the option of deleting any other files that exist in the Port Explorer directory that were created after install. These files are documented here. All keys in the Port Explorer registry location are also deleted (HKEY_LOCAL_MACHINE\Software\Diamond Computer Systems\Port Explorer\)


Registered Users

Registered users of Port Explorer will need to ensure they copy their unlock code from the Members Area. Once you have logged into the Members Area using the details we send you and copied the unlock code, you simply enter that into Port Explorer next time you run it. This will unlock Port Explorer turning it into the full registered version.

You can enter this code in one of two places. If your evaluation version has expired, the window which pops up when you run it has an "Enter Unlock Code" button. Simply click your mouse on this button and enter the code in. The other way to enter the unlock code if the program has not expired yet, is to click on the Help menu item, then click on Register.

It is easier to copy/paste the unlock code than it is to manually write it out. To copy/paste some text you simply need to SELECT the text you want to copy with your mouse (simply hold down the left mouse button and move the mouse over the text) then press the CTRL key combined with the C key. Alternatively there should be an EDIT menu on your program which has a COPY item in it. Then to paste the copied text into Port Explorer, simply press the CTRL key combined with the V key after ensuring the cursor is flashing in the area you to copy it into.


Interface

Main Interface

The main Port Explorer interface is completely resizable, and can be divided into six main sections:

1. The Menu System
The menu system is iconic and language-dynamic so you'll never have any problems finding your way around the program.

2. The Tab Array
The different tabs allow you to view different classes of sockets. For example, if you only want to see TCP ports, select the TCP tab. The tabs are:
All - all sockets.
 TCP - all TCP sockets.
 UDP - all UDP sockets.
 Remote - all sockets with remote addresses that aren't local.
 Listening - all TCP sockets that have a status of LISTENING, showing all listening ports.
 Established - all TCP sockets that have a status of ESTABLISHED, showing all current connections.

3. The Column Headers
Re-sizeable and position-interchangeable, column headers allow you to easily sort and filter data the way you want. The order and size of the columns is automatically saved and remembered by Port Explorer.

4. The Socket List
All information Port Explorer is able to determine about sockets on your system is displayed here. The data displayed here depends on which tab has focus. Other settings can affect the display, these include:
Show Resolved Addresses - if selected, numeric IP addresses that can be resolved will display as resolved addresses.
Hide Netstat Sockets - if selected, --NETSTAT-- sockets will not be displayed.
Show Process As - this affects how the process name is displayed (filename only, full path, or program name)
For more information about what is displayed in the Socket List, see Socket Data Overview

5. The Traffic Log Window
All network events are logged to this window (if Window Logging is enabled). This information can also be logged to a file using the File Logging capability. For more information about what is displayed in the Traffic Log window, see Traffic Log.

6. The Status Bar
The Status Bar has three subsections:
Socket Count - How many total sockets (system, hidden, and normal) are being displayed.
Administrator Privilege - Displays whether Administrators Privilege was obtained.
Operating System - Displays the operating system Port Explorer is running on.
These counts are indicative of the sockets currently being displayed, which depends on the Tab that is currently selected. It does not display the count of all sockets unless you're on the All tab.

Main Window
Like the column headers, the size and position of the main window is automatically saved and remembered by Port Explorer.


Menu System

The menu system in Port Explorer has been enriched with icons and keyboard shortcuts to make menu navigation easy and aesthetically pleasing.

File

Save Table
Allows you to save the current Port Explorer list to a file. Two format options are available:
Formatted Text File (.txt)- This format is visually easier to read
Comma-Separated Values File (.csv) - This format is easier for programs (such as Excel) to read.
The text is saved exactly as it is seen in Port Explorer - even row and column positions and ordering are preserved.

Refresh View F5
Manually refreshes the list. This is useful if Automatic Refresh is turned off.

Exit Alt+F4
Shuts down the Port Explorer program. You can also shut down Port Explorer by pressing Alt+F4, or by pressing the "X" button next to the minimise and maximise buttons in the top right-hand corner of the main Port Explorer window.

View

Always on Top
Forces the main Port Explorer window to remain on top of the windows of other applications.

Minimize to Systray
Port Explorer will create a small icon in the system tray in the bottom right-hand corner of your Windows task bar. Right-clicking on this icon will produce a popup menu showing the following:
Hide Window - Hides the main Port Explorer window
Restore Window - Displays the main Port Explorer window
Exit - Shuts down Port Explorer

Disable Sorting F3
If selected, Port Explorer won't sort the list - new items will simply be appended to the end of the list. This may improve performance on slower machines with large amounts of sockets.

Colors
You can change 8 different color settings to give Port Explorer the look and feel you prefer. Color changes are automatically saved and remembered by Port Explorer, but if you ever want to go back to the default settings, simply press the Restore to Default submenu item.

Choose Font
You can choose which font is used in the main Port Explorer list. The default is Verdana (Regular) at size 8.

Show Log Window
If selected the Traffic Log window will be visible.

Large Icons
Process icons will display with pixel dimensions of 32x32 rather than 16x16. If Large Icons is selected the font size of the list is also automatically increased.

Show Grid
Displays a grid in the list which may make it easier to find specific information in the list.

Settings

Pause Display F2
Prevents any automatic refreshes from occurring, essentially pausing the display.

Automatic Refresh
If selected, the display will automatically refresh at an interval determined by Refresh Interval.

Refresh Interval
The interval in seconds for the automatic display refresh. Available options are 1, 3, 5, 10, or 30 seconds.

Window Logging
Options to enable/disable traffic logging, restrict the size of the window log, and disable size restrictions.

File Logging
Options to view/clear the log file, restrict the size of the log file, enable/disable file logging, and disable size restrictions.

Show New/Dead Sockets For
The interval in seconds for how long new or dead sockets should remain in the list. New/dead sockets can be identified by their color-highlighted background. Available options are 1, 3, 5 or 10 seconds.

Show Resolved Addresses
If selected, Remote Address and Local Address columns will display resolved addresses (when possible) rather than numeric IP addresses.

Show Process As
Determines how the process name should be displayed. Available options:
EXE Name - The filename only (eg. "telnet.exe")
Full Path - The full path and filename (eg. "d:\winnt\system32\telnet.exe")
File Information - The program name, taken from its Version characteristics (eg. "Windows Telnet Client")

Reduce Memory Usage
Selecting this option will safely move the Port Explorer process out of physical RAM memory, freeing up memory for other processes in doing so. This may or may not have any noticeable effect on Port Explorer's performance, but any degradation will be minimal and not very noticeable. Under Windows NT/2000/XP you can easily see the memory reduction by watching the Mem Usage column of the portexplorer.exe process in Windows Task Manager. Port Explorer is by design a very memory-economic program, but we've built this feature in to cater for systems with older processors and/or not much memory.

Hide Netstat Sockets
Hides all '---NETSTAT---' sockets. These are sockets that were created very early in the boot process of your system, and were created before Port Explorer initialised. They are usually safe to ignore.

U tilities

Port Explorer comes with several utilities that allow you to perform advanced network operations from within Port Explorer itself.

Lookup - A simple database lookup facility that provides four searches:
Port to Service - Searching for a port such as '23' will return 'telnet'
Service to Port - Searching for a service such as 'telnet' will return '23'
Country to Domain - Searching for a country such as 'Australia' will return '.au'
Domain to Country - Searching for a domain such as '.au' will return 'Australia'

Ping/Traceroute - Two similar utilities commonly used by network administrators.
Ping allows you to determine if a remote host is 'alive'. It does this by sending ICMP request packets, essentially asking "are you there?". If the remote host is alive and its firewall allows it to send/receive such ICMP packets, the remote host will respond "yes I'm here".
Traceroute is very similar to ping and also uses ICMP packets, but rather than just attempting to determine if the remote host is alive, Traceroute attempts to literally trace the route between your system and the remote host, allowing you to see which computers your data moves through on its journey to the remote host.

Resolve - This simple utility allows you to resolve numeric IP addresses (such as 202.6.126.12) to their DNS host address (www.diamondcs.com.au), and vice-versa.

Socket Spy - The most advanced utility in Port Explorer, Socket Spy actually gives you the ability to packet-sniff (capture and record data packets that are sent/received). Unlike conventional packet-sniffers, Socket Spy allows you to eavesdrop on individual sockets and processes so you can zero in on the sockets you want to analyse without being flooded by data from other sockets.

Statistics - Provides a wealth of TCP, UDP, IP and ICMP real-time statistics on your system.

Whois - Whois is a database service originally maintained by the Network Information Center (NIC) at SRI International on behalf of the Defense Communications Agency (DCA). It accepts search queries of domain names, IP addresses and more, and returns information such as full name, mailing address, telephone number, email address, DNS server(s), network mailbox(es), and more. The Whois utility built into Port Explorer allows you full unrestricted access to this information by providing an intelligent automatic search function which returns fruitful results on the majority of the worlds Internet addresses (allowing novice users to find the information they want simply by typing in the target address) , and also provides manual capabilities for advanced users who wish to explicitly query Whois servers.

Command Prompt - Launches your command prompt, where you can then immediately utilise console applications that come with Windows, such as netstat and nbtstat

Please see the Utilities section in this help manual for detailed information on each utility.

L anguage

The Language menu allows you to select the language that Port Explorer will use. Selecting any language will instantly change the text in Port Explorer to the language selected.

Please see the Language section in this help manual for more information.

H elp

Index F1
Opens the Port Explorer help manual (what you're reading now) at the Index page.

Members Area
Licensed Port Explorer users have the advantage of being able to enter our Members Area - strictly for licensed Port Explorer users only!

Check For
New Version of Port Explorer - Connects a socket to www.diamondcs.com.au:80 to check if a new version of Port Explorer is available. If there is, a Yes/No messagebox will be displayed, asking you if you want to download the new version. Clicking Yes will open your default browser at the Port Explorer download page.
New Port and Domain Databases - Connects a socket to www.diamondcs.com.au:80 to check if new Port and Domain databases are available. If there is, a Yes/No messagebox will be displayed, asking you if you want to download the new databases. Clicking Yes will re-connect a socket to to www.diamondcs.com.au:80 and download the files automatically. The new databases are loaded automatically so there is no need to restart Port Explorer.

Go To
Port Explorer website - Launches your default web browser to http://www.diamondcs.com.au/portexplorer
 DiamondCS website - Launches your default web browser to http://www.diamondcs.com.au

About
Displays the About box and license registration information.
Licensed users will have five or six fields displaying, these are:
Name - The name your keyfile is registered to. eg "John Smith", "Riverside University"
Email - The primary contact email address of the owner of the registration keyfile
Region - The region (country) the license is to be used in. eg. "Australia"
Licenses - How many computers the keyfile may be used on, normally 1. "Use" is also displayed in brackets. eg. "Personal use", "Educational use"
Registered - The date the keyfile was created
Expires - When the keyfile expires. This field is not visible on non-expiring keyfiles.


Right-click Popup Menu

Right-clicking on a socket in the main Port Explorer window will activate the Right-click Popup Menu:

This menu makes it easy to perform specific tasks on the socket and process of the socket entry that you right-clicked on.

There are 11 primary submenus:

Process / Socket
Two submenus that operate in very much the same way, except that Socket only applies to the one individual selected socket, and Process applies to the process of the selected socket (and consequently, all of its 'child' sockets). Depending on whether you select "Process" or "Socket", the operations will either work on all sockets owned by that process, or just the individually selected socket.
 Available options are:
Kill Process/Socket - Will say "Process" or "Socket" depending on which primary submenu you clicked on. Kill Process will terminate the socket's parent process, while Kill Socket will attempt to close just the individual socket.
Disable Sending - Prevents the socket(s) from sending data.
Disable Receiving - Prevents the socket(s) from receiving data.
Set Max. Send Speed - Allows you to set a "throttle" on how much data can be sent per second.
Set Max. Recv Speed - Allows you to set a "throttle" on how much data be be received per second.
Enable Spying - Starts capturing all data sent and received by the socket(s).
View Spy Info - Activates the Spy Socket utility.

What is Local Port
Performs an automatic service lookup of the local port number. For example, "What is Local Port 23" will reveal that telnet uses port 23.

What is Remote Port
Performs an automatic service lookup of the remote port number.

What is process
Launches the Properties dialog for the file of the process.

Resolve address
Attempts to resolve the numeric remote IP address.

Ping address
Launches the Ping utility and automatically starts attempting to ping the remote address.

Trace address
Launches the Traceroute utility and automatically starts attempting to trace the route to the remote address.

Whois address
Launches the Whois utility and automatically attempts a Whois lookup on the numeric remote IP address.

Whois Resolved Host
Launches the Whois utility and automatically attempts a Whois lookup on the remote resolved address.

Clipboard
Allows you to quickly copy the process name, remote port, remote IP address, and resolved address.


Socket Data Overview

Port Explorer can provide a lot of information about a socket, from everything that netstat is able to determine (protocol, local address, local port, remote address, remote port, socket status) to more advanced information (process, process ID, creation timestamp, and Sent/Received byte and packet counts. In most cases, Port Explorer is able to determine the owner process of a port (that is, it is able to map the port back to its parent process). It builds a table of all such ports that it is able to map, and then builds a second table, this time just using the same information that is retrieved by the netstat program. Finally, the two tables are combined, and Port Explorer then fills the socket data list with the combined table. (Exception - if Hide Netstat Sockets is turned on in the Settings menu, the netstat sockets will not be added to the combined table). The combined table is automatically filtered by Port Explorer so that there are no double-ups (i.e. if a socket appears in the first table, it won't be added to the second table). This whole process is usually done by Port Explorer in the blink of an eye, which allows you to choose Display Refresh rates as fast as 1 second.

You may see something like this:

So what does all of this mean? If you're a beginning user, please don't be discouraged if you don't immediately understand this information. It may initially look daunting ("what do all these numbers mean?!"), but it is actually very simple, and with a little patience and reading you'll soon master this information.

Lets compare the two lines. As you can see, compared to the second line (the --NETSTAT-- one) we can see that the first line has been successfully mapped by Port Explorer as all fields have been filled in. This information is from the first table Port Explorer builds. The second line is missing some data, such as Creation timestamp, process, process ID, and Sent/Received counts. This information is from the second table Port Explorer builds. What we are seeing is the combined table - in this case, one socket from each table.

Now lets examine the first line more closely. As we can see, d:\winnt\system32\telnet.exe is the process or program that is using this socket. We can see that its Process ID is 608, and if we're using Windows NT, 2000, or XP, we can press Ctrl+Alt+Delete on our keyboard to select Task Manager, which will also confirm that process 608 is used by telnet.exe. We can see that the socket was created at 11:53am (24-hour time format) on the 1st of October, 2002 (day-month-year format). We can see that the protocol is TCP (which is a connection-based protocol, as opposed to the connectionless UDP protocol - see the Glossary of Terms for more information). The local address is the address of our computer, and the local port is the port number being used by our computer. The remote address is the address of the computer that we are connected to, and the remote port is the port number they are using. The status says ESTABLISHED, so we know that the connection is currently alive and established. The TIME_WAIT status is explained in the Glossary of Terms. We can see that there has been 0 packets (and consequently 0 bytes) sent by the socket, but it has received 1 packet and a total of 100 bytes.

By right-clicking on the socket and selecting 'What is Remote Port 25?', we'll see that port 25 has two uses - SMTP, and remote access trojans (and quite a few of them!). SMTP, or Simple Mail Transfer Protocol, is a protocol mail servers use to receive and send mail. We can now assume that telnet.exe has simply connected to an SMTP mail server, and the mail server has sent back 1 packet that contains 100 bytes of information - usually a greeting indicating what sort of mail server it is and/or what protocol it uses.

By right-clicking on the socket and selecting 'What is telnet.exe (608)?', we'll see the Properties dialog appear with General, Version, Security, and Summary information. The timestamps in the General tab are particularly interesting - the Accessed timestamp is usually the time the process was started. The Created timestamp allows you to see when the file was created on your system (which, in the case of telnet.exe, should be the same time that you installed the operating system). The Version tab allows us to see version/copyright information embedded in the executable.

Now lets examine the second line. The process is specified as '--NETSTAT--' because it is one of the few ports that Port Explorer was unable to map back to its parent process. For this reason its Process ID is 0, and it has no creation date. The Sent/Received counts are also unable to be determined, but all other information is available, exactly as it would be seen in netstat.

That's all there is to it!


Socket colors

Sockets in Port Explorer are displayed with text in any one of three colors. These colors are configurable (View menu), but by default they are black, blue and red. The color of the socket is not related to the nature of the socket itself but rather the process that owns it.

Black - Normal Sockets
Most sockets from applications started by the user will display as black. This means the owner process of the socket is a visible application - it has a window that is visible on-screen (although it may be minimised). It is possible but highly unlikely that trojan sockets will display as black.

Blue - System Sockets
Blue sockets indicate ownership by either the System process or by a registered service process (usually started by the operating system). It is possible for trojans to register themselves as service processes, but this is very rare.
See also Notes on Services

Red - Hidden Sockets
Red sockets indicate that the owning process is hidden (ie. it has no visible windows) and is not a service or system process. Although there are some legitimate applications that behave this way, many hidden sockets are owned by trojans, so red-socket processes are always worthy of further investigation. In fact, very few

Red (Background) - Closing Sockets
Sockets with red backgrounds are sockets that have just closed. The red background remains for one 'refresh', allowing you to see sockets as they close rather then having them immediately disappear.

Notes:
It is not practically possible to determine if a process has an icon in the system tray as the system tray icon is handled by the explorer.exe process, not the process, so hidden processes that have a system tray icon will still show up as red.

Port Explorer maintains a tally of each socket class. These tallies (and combined total) can be seen in the status bar at the bottom left-hand corner of the main Port Explorer window.


Traffic Log - Realtime Traffic Reporting & Logging

The Traffic Log utility in DiamondCS Port Explorer reports traffic as it happens, allowing you to see exactly what network events are happening on your system, in what order, and from which process(es). Port Explorer allows you to save the log to a file as it happens, or simply report it on-screen. It's a great way to see if any unknown or unwanted software is transmitting/receiving data, very helpful in testing, detecting and troubleshooting network problems and bottlenecks, and makes it easy to see all network activity on your system.

Window Logging
The Window Logging capability allows you to see the Traffic Log on-screen in realtime, and is built into the main interface for easy viewing.

The columns provide the following information.
# - The event ID, generated in order of occurance. For example, #1 is the first network event recorded, #2 is the second, and so on.
Time - The exact time the network event was generated (hour:minute:second).
Process:PID - The process filename and numeric process ID that generated the network event.
Action - The type of network event. These include Send, Receive, Open, Connect, Listen, Accept, and Close.
Protocol - The network transport protocol being used (such as TCP or UDP).
Local Address - The local IP address and local port being used in the network event.
Remote Address - The remote IP address and remote port being used in the network event.
Status - All network events return SUCCESS or FAILED.
Bytes - How many bytes were transmitted. This only applies to SEND and RECEIVE network events. If the action is SEND, Bytes indicates how many bytes were sent from the local host to the remote host. If the action is RECEIVE, Bytes indicates how many bytes were sent from the remote host to the local host. To see what data is being transmitted you can use the Socket Spy utility.

Window Logging can be disabled by selecting the Settings | Window Logging | Disabled menu item. The Window Logging window can be hidden by deselecting the View | Show Log Window menu item.

File Logging
 The File Logging capability allows you to automatically log all traffic to a file. The file is saved as PELOG.TXT in your Port Explorer directory, and is recorded in a similar format to Window Logging, as seen here:
------------------------------------------------------------------------------------------------------------|
|         DATE        |ACTION | PRO |   Local Address:Port | Remote Address:Port  | Status | Bytes | Process
------------------------------------------------------------------------------------------------------------|
24/02/2003 14:37:43pm   OPEN    TCP        0.0.0.0:0              0.0.0.0:0        Success          D:\telnet.exe:956
24/02/2003 14:37:43pm  CONNECT  TCP     10.0.0.85:1420           10.0.0.9:25       Success          D:\telnet.exe:956
24/02/2003 14:37:48pm  RECEIVE  TCP     10.0.0.85:1420           10.0.0.9:25       Success    100   D:\telnet.exe:956
24/02/2003 14:38:08pm   SEND    TCP     10.0.0.85:1420           10.0.0.9:25       Success     1    D:\telnet.exe:956

With the exception of the last field ("Process") all fields are fixed-width, making it easy for 3rd-party developers and administrators to write their own custom parsers.

File Logging can be disabled by selecting the Settings | File Logging | Disabled menu item. The logfile itself can be viewed simply by selecting the Settings | File Logging | View File Log menu item.


Lookup Utility

Lookup

The Lookup utility is a simple database search engine that allows you to perform five (5) different search types. The data used in the searches is stored in ports.dat, ip.dat, and domains.dat. These files must be present in the Port Explorer directory or the Lookup utility will not be able to work.

IP to Country
Allows you to determine which country any IP address belongs to, using Port Explorer's built-in IP database and powerful IP-to-Country capability. For example, searching for 207.46.134.190 would instantly show the following:
 United States
Port to Service
Searching for a port such as '23' will reveal that the following known services use that port:
 Telnet Protocol (RFC 854), WinGate, RAT: Fire HacKer, Tiny Telnet Server - TTS, Truva Atl, RTB666, TelnetPro 1.0, Swarm, Baron Night, AlphaDog, MMX, Net Coach, PEST

Service to Port
Searching for a service such as 'SMTP' will reveal the following:
 --Port 25--
SMTP - Simple Mail Transfer Protocol (RFC 913), RAT: Ajan, Antigen, Email Password Sender - EPS, EPS II, Gip, Gris, Happy99, Hpteam mail, I love you, Kuang2, Magic Horse, MBT (Mail Bombing Trojan), Moscow Email trojan, Naebi, NewApt worm, ProMail trojan, Shtirlitz, Stealth, Tapiras, Terminator, WinPC, WinSpy
--Port 465--
SSMTP - SMTP Protocol over TLS/SSL (was ssmtp)

Country to Domain
Searching for a country such as 'Australia' will reveal the following:
 Australia = .au
Christmas Island (Australia) = .cx
Cocos (Keeling) Islands (Australia) = .cc
Cook Islands (Australia) = .ck
Heard And McDonald Islands (Australia) = .hm

Domain to Country
Searching for a domain such as '.au' will reveal the following:
 .au = Australia

To ensure you're using the latest databases, simply click on the Help menu in Port Explorer, then select the Check For submenu, then New Port and Domain Databases


Ping/Traceroute Utilities

Ping/Traceroute

Ping and Traceroute are two related network utilities that are commonly used by both Network Administrators and regular users alike.

Ping allows the user to determine if a particular host is alive by sending an ICMP Echo request. If the remote host is alive it should respond with an ICMP Echo reply.

Traceroute allows the user to determine the route packets are taking to a particular host. Traceroute works by increasing the time-to-live value of packets and seeing how far they get, until they reach the given destination; thus, a lengthening trail of hosts passed through is built up.

Ping and Traceroute both require the transmission and receipt of ICMP packets. Firewalls, routers and network configurations can affect the performance and results of such utilities by modifying or dropping ICMP packets, and may even block the ping/traceroute altogether.

There are six variables that you can adjust to customize the pings and traces, these are:
Pings - the number of times to send a ping request (default 4)
Size - size of the ping request (default 32)
Timeout - how long each packet should wait (default 1000 milliseconds)
Max Hops - the maximum number of destinations a packet is allowed to traverse.
Don't Fragment - sends the ping request as one packet (larger packets are normally fragmented into smaller packets, unless this flag is set)
Resolve Hosts - IP addresses will be resolved and displayed when possible.


Resolve Utility

Resolve

The Resolve utility allows you to resolve numeric IP addresses back to their corresponding DNS address, and vice versa.

For example, if we want to resolve www.diamondcs.com.au, enter that address in the Host field, then press Enter on your keyboard or press the Resolve Host button with your mousecursor.
The result: www.diamondcs.com.au resolves to 202.6.126.12, and the country was correctly determined to be Australia, which is geographically highlighted on the world map in the Resolve utility window.

In the reverse case, if we only know the IP address (202.6.126.12) and want to resolve that, enter that address in the IP Address field and press Enter on your keyboard or press the Resolve IP button with your mousecursor.

Note: Addresses are subject to change without warning.


Statistics Utility

Process List

The Process List utility allows you to see all processes that are currently active on your system. In addition to the process filename, other information displayed includes the icon of the file, process ID, and full file path. The total number of processes can be seen in the Process List window title.

To obtain more information about a process, simply select the process by clicking on it, then press the View button to bring up the Process Viewer window, which also optionally allows you to kill the process. Double-clicking on a process also invokes the Process Viewer.

For your convenience, the Process List utility is linked to the Socket Spy utility to make it easier to add processes to the Socket Spy list. Next to the "Add PID" button in the Socket Spy window, there is now a small button ("..."). Clicking this invokes the Process List utility, and then when you select a process and click the OK button, its process ID will be automatically added for you.


Socket Spy Packet-Sniffer Utility

Socket Spy

This utility is for experienced users.

The most advanced utility in Port Explorer, Socket Spy actually gives you the ability to packet-sniff (capture and record data packets that are sent/received). Unlike conventional packet-sniffers, Socket Spy allows you to eavesdrop on individual sockets and processes so you can zero in on the sockets you want to analyse without being flooded by data from other sockets.

For a detailed example explaining how to use Socket Spy, please see Socket Spy: Packet-sniffing with Port Explorer in the Advanced section.


Statistics Utility

Statistics

Displays per-protocol network statistics. Such information can reveal how many bytes have been sent/received, how many active connections are open, how many ICMP messages have been received, and much more.

The protocols displayed are:
TCP - Transmission Control Protocol
UDP - User Datagram Protocol
IP - Internet Protocol
ICMP - Internet Control Message Protocol

To refresh the statistics, press the Refresh Now button. Alternatively, if Auto Refresh is turned on, statistics are refreshed every second.


Whois Search Utility

Whois - Search Client

The Whois utility built into Port Explorer may initially look like a relatively small utility, but don't let looks deceive you - it is a powerful search engine client that gives you full 100% unrestricted access to the domain registry database servers of the world, and best of all it's easy to use thanks to a built-in intelligent automatic search feature.

Domain registry database servers (Whois servers) are Internet servers that run a Whois service on TCP port 43, providing free instant information to anything that sends it a query. Port Explorer's Whois client allows you to search all of these databases to find information about domains, domain owners, IP addresses, companies and more. Information returned from the Whois server can often include things such as the address owner, owner's title, contact phone number, postal address, email address and more.

There are many competing registrars and each one only hosts information about domains that are registered through it. For example, .au (Australian) domains are registered through aunic (http://www.aunic.net). Thus, to search for information on a .au domain, you need to send your query to the aunic server (whois.aunic.net). Most countries have a single Whois server, but some have multiple servers, each handling a different second-level domain (2LD). The .com/.net/.org domains are different because these domains have been deregulated, and now competing registrars hold the Whois information for those domains that are registered with it. The best way to search for a .com/.net/.org domain is to send your query to whois.internic.net, which will then refer the Whois client to the appropriate Whois server that handles the domain or address you requested. Port Explorer's Whois client supports automatic referral and multi-referral transfer.

To find out about the flags a server will accept and all its legal information, just select the Whois server you want to know more about and just enter "?" or "help" as your search query.

Please note that it is not possible to obtain Whois database information on all domains and addresses as there are no laws that require that information to be present. Additionally, many Whois databases are only updated monthly, so it can be harder to obtain information about brand new domains.

Automatic Search - Recommended for most search queries
As outlined above there is no single Whois server to send all your search queries to, and with a complex system of competing registrars, custom database formats, server referrals and other quirks, how do you know which server to start at? With the Automatic search built into Port Explorer's Whois utility, you don't need to worry about any of that - simply type in a domain or IP address to connect to and press Enter on your keyboard, or press the Search button to activate the search. We've worked hard on the Automatic search feature to ensure that it is as reliable as possible - it rarely fails, and Automatic Search may be the only search you'll ever need to use.

When Whois is activated from the right-click popup menu on the main display window, the IP address query automatically goes to whois.arin.net by default. If the address is in the form of a host then it will automatically use Automatic Search.

Manual Search - Recommended for advanced users should Automatic search fail to yield results
Manual searching allows you to send any query to any Whois server in the world. For example, the microsoft.com domain is registered with Network Solutions, so you can directly go to whois.networksolutions.com simply by selecting Other in the server list and typing in the Whois server address in the textbox that becomes visible.

Most Whois servers accept flags with the search query. Accepted flags will usually be told to you in the output display. Sometimes putting an "=" sign before the hostname is needed to specify all the records of the name you gave.

On some servers you can also search on peoples names just by putting in the name of the person you are searching for. It usually has to be "last name, first name" or just "last name" format to work.

Legal note - Please be aware that when you submit queries to Whois servers, you are agreeing to their Terms of Use. To display the terms of use, simply search for "?" or "help" at any Whois server. Generally speaking, most Terms of Use simply outline that you shouldn't use the information provided by Whois servers for any unlawful purposes or for the purpose of advertising. Please do the right thing, respect and abide by their Terms of Use - they're providing you with a wealth of free information after all and if the system is abused then its future could be jeopardised.


Command Prompt

The Windows command prompt can be very useful as it provides direct access to many console applications that come with the Windows operating system.

Here are some useful network commands you might like to try from the command prompt:

netstat | Displays protocol statistics and current TCP/IP network connections.
netstat -r | Displays the routing table.
netstat -s | Displays per-protocol statistics.
netstat -e | Displays ethernet statistics.
netstat -an | Displays all connections and listening ports in numerical form.
netstat -ano | The same as netstat -an, but also displays the parent process *Windows XP only
nbtstat -s | Lists sessions table converting destination IP addresses to computer NETBIOS names.
nbtstat -n | Lists local NetBIOS names.
route print | Displays the network routing tables.
net accounts | Displays network accounts settings.
net view | Displays the network neighbourhood..

You may have to be in your Windows system directory before using these commands, as that is where the program files exist.


Switching Languages

A screenshot of Port Explorer with the Dutch language selected

We've worked hard to ensure that Port Explorer has an open interface that can easily be translated to languages other than English, and switching languages in Port Explorer couldn't be easier - simply click on the Languages menu from the main display window, then click on the language you wish to use. That's all there is to it - Port Explorer will automatically adjust all text in the program 'on-the-fly' to the language selected using its built-in multi-language engine.


Translating Port Explorer

If you are fluent in a language that Port Explorer doesn't have but that is spoken by more than 10 million people then please consider translating Port Explorer. In return, you'll be acknowledged in this help file, the Port Explorer About window will display your name as the translator, and we'll even send you a free non-expiring keyfile for Port Explorer in your name.

To view the language translation file, please download this file:
http://www.diamondcs.com.au/portexplorer/language.txt

Please email the translated version to portexplorer@diamondcs.com.au. Within a couple of working days we'll send you your own private keyfile to use with Port Explorer, along with a new private build with your translated language built in. We'll then wait for confirmation from you that everything is ok and that no texts need changing before we make the language available to the public.


Translators

Port Explorer Translators

We graciously thank the following kind people for donating their time and translation skills so that more people around the world can enjoy the power of Port Explorer with an accurate translation in their native language.

Dutch | Jooske van der Burg (Beta Tester)
English | Jason Annice (Port Explorer Lead Programmer)
French | Matthieu Gosset
German | Frank Rogall
Italian | Maurizio Zucchelli
Portuguese | Fred Tillman (Beta Tester)
Spanish | Antonio Perez and Rodrigo Soto
Swedish | Mattias Flodin and Ludvig Strigeus

We would not be able to make Port Explorer a truly international application without the help of these generous people.

For privacy reasons we don't disclose the email addresses of translators, but if you would like to contact a translator please send your message to portexplorer@diamondcs.com.au and we will forward your message directly to the translator. However, we cannot guarantee that you will receive a reply from them - this is the sole discrepancy of the translator.


Notes on Service Processes

Bandwidth Control

Port Explorer allows you to set send and receive limits on individual sockets and/or processes. This means you can now control how much bandwidth a particular application or socket may have, giving you unprecedented control over your network.

To use Port Explorer's bandwidth control all you need to do is right-click on a socket in the main Port Explorer table. This menu will appear:

Click on either the Process or Socket submenu and you will be presented with this:

Now a dialog will appear asking you how much you want to limit the particular process or socket:

One thing to note is that if you use bandwidth control on a process it doesn't control how much bandwidth there is for that whole application, but rather what each socket created by the process will have. For example, if you specified a 30 kilobyte send speed limit for a process that had 3 sockets, each socket would have a 30 kilobyte limit, not 10 kilobytes each.

To REMOVE speed limits, simply set the value to 0.


Hidden Server Detection

This information is provided for experienced users.

Hidden Server Detection is a powerful new world-first detection technique developed here at the DiamondCS lab exclusively for trojan detection. The technique itself is theoretically simple yet programmatically complex, but for you the user it simply means the detection of live remote access trojans and spyware has now never been easier - all you have to do is look!

Remote access trojans are a menace to the Internet and a very high risk to all Internet users. Unlike worms and viruses, trojans almost always have a human directly behind them, who controls the trojan to take ownership of the target computer(s). At DiamondCS we've been researching trojans and developing countermeasures intensively for over half a decade, and our TDS anti-trojan system (http://tds.diamondcs.com.au) has been regarded by experts as the most comprehensive anti-trojan system available. The anti-trojan advances we've made in TDS have flowed into Port Explorer, so Port Explorer isn't just a socket explorer/analysis tool - it's actually a very powerful anti-trojan tool.

Nearly all trojans have one thing in common - they sit alive on your computer, running in the background as an invisible process (no windows, no taskbar icons, or anything visible on-screen), with a socket listening on a port (usually TCP). It's these characteristics that Port Explorer zeros in on.

When Port Explorer finds a socket (this does not apply to '-NETSTAT-' sockets), it examines the parent process to determine if the process is displaying anything visible on-screen. If the process has nothing on-screen, Port Explorer will highlight the socket in a different color (red by default). This does not necessarily mean that the process is a trojan, but it does mean that the process is running hidden and is using sockets so it is worthy of further investigation.

This image is an actual screen capture of Port Explorer taken on a Windows 2000 system that was infected with the common remote access trojan "NetBus":
Port Explorer has determined that the process doesn't have any visible characteristics, so consequently the process has been highlighted in red. You can view more information about the file by right-clicking on the process and selecting "What is <process>?". The Status column shows that the process has two listening sockets. The socket listening on TCP 12345 is the main port that the trojan uses for communications. The second port (TCP 12346) is used for data transfer (files, screen captures, etc), some trojans will listen on only one port at a time.

Terminating a trojan...
Now that we've identified the trojan, terminating it (killing its process) is simply a matter of right-clicking on the process and going to the Process submenu. Then simply press "Kill Process". If the attempt to kill the process fails, you'll be alerted with a messagebox. You won't see any message if the kill succeeds but you will notice the sockets belonging to that process disappear from the list. Now that the trojan process has been terminated, you can delete the file (d:\winnt\patch.exe in this case).

Advanced techniques for experienced users

These techniques do not apply to '-NETSTAT-' sockets.

Neutralising a trojan...
Without terminating the process, Port Explorer actually gives experienced users the capability to render a trojan virtually harmless yet still keep it alive by blocking it's capability to send data. This is ideal for honeypots that wish to record data that is received (for security or analysis purposes) but ensure no data is sent back. Blocks can be applied to either the entire process or individual sockets so you have complete control over send/receive capabilities of every process and socket on your system. To do this, simply right-click on the socket you wish to impose a block on, and go into the Process or Socket submenu (depending on whether you want to apply the block to the socket or the entire process). Then it's simply a matter of selecting "Disable Sending" or "Disable Receiving". Sending/Receiving can be enabled/disabled using this method - the menus will indicate if blocking is enabled by displaying a check beside the menu item.

Spying on a trojan...
Spying on the communications of a trojan allows experienced curious users and trojan analysts to document and analyse the protocol (the custom "language" that the trojan server and client speak to each other). This is best done with a neutralised trojan - experienced users may want to capture and analyse the data that is sent to the trojan socket. This is easily done simply by right-clicking on the desired process, going to the Process or Socket submenu, and selecting "Enable Spying". All data that is then sent/received by that process or socket is captured by Port Explorer and saved to a log file. The log file can be viewed by the Socket Spy utility, available in the Utilities menu. For more information, see Packet-sniffing with Socket Spy


Socket Spy

Socket Spy: Packet-sniffing with Port Explorer

This information is provided for experienced users.

The ability to "packet-sniff" (capture data that is sent/received by your system) is a very useful capability to have at your disposal. Just some of the things a packet-sniffer allows you to do include:
  • View and analyse the data that is currently being transferred to/from your system, a particular process, or socket.
  • Log/record communications made between a client and server.
  • Ensure that no sensitive data has been transferred.
  • Document and analyse a protocol to determine how the client and server interact with each other.

While Port Explorer isn't a dedicated packet sniffer (that is just one of its many features), it does have remarkable packet-capturing capabilities for a program of its nature, and should accommodate the packet-capturing needs needs of most users including experienced users. Port Explorer provides advanced non-intrusive packet-sniffing and doesn't interfere in any way with the socket(s) or process(es) being monitored, and unlike most packet-sniffers, Port Explorer gives you the ability to eavesdrop on individual sockets and processes so you can zero in on the sockets you want to capture data from without capturing data from sockets you want to ignore.

Spying on a process or socket is as simple as right-clicking on it in the list, selecting the Process or Socket menu, and then selecting "Enable Spying". All data sent/received by the socket(s)/process(es) being monitored is then saved immediately as it is captured to capture.bin (in your Port Explorer directory). This file is not encrypted or compressed but is of a custom format - to view it properly, use the Socket Spy utility in Port Explorer - simply press the "Packet Data" radio option to view captured packets.

Please note that packet-sniffing of any kind adds a small amount of latency to captured transmissions due the the extra processing overhead. Such latency may not even be noticeable, but we recommend using Socket Spy only when needed, ensuring it is turned off when you're not using it.

For a detailed explanation on using Port Explorer, please see the following two examples:
Example 1 - Capturing a request to retrieve a web page
Example 2 - Capturing all sent and received data from a process


Socket Spy - Example 1

Socket Spy: Packet-sniffing with Port Explorer

Example 1: Capturing a request to retrieve a webpage

The easiest way to test a packet-sniffer of any type is to capture data that you already have (for example, a known web page). The reason for this is so that you can then compare the captured data to the existing known-good data to ensure it is the same and has been received in its entirety.

In this example, we'll record the traffic between a client (telnet - a common utility found on most operating systems) and server (a web server located at www.diamondcs.com.au), where the client will make a simple 'HTTP GET' request to retrieve a page from the www.diamondcs.com.au web server. We're using telnet for this demo because it makes it a lot easier to see the data being received by the client (telnet), but for all intensive purposes you could use a web browser instead of telnet.

Our target is http://www.diamondcs.com.au/portexplorer/spytest.htm
spytest.htm is a file exactly 100 bytes in size. It contains just one line of text (no carriage-returns or line-feeds):
  <html><title>Port Explorer: Socket Spy Test</title> <body>Hello there, packet-sniffer!</body></html>

We'll now use telnet to connect to the www.diamondcs.com.au webserver and request a web page, in very much the same way a web-browser would. To do this, from Windows click on Start, then Run, then enter this command:
telnet www.diamondcs.com.au 80
Look in the main Port Explorer window to find the telnet socket - it should be easy to find, simply look for a socket that has telnet as the process, www.diamondcs.com.au as the remote host address, and port 80 as the remote port. When you have found this socket, right-click on it and go into the Process submenu, and select Enable Spying. Port Explorer will now capture all packets sent/received by this particular telnet process.

Now we'll use telnet to send a request to retrieve a webpage, just as a web-browser would. After the connection is established, type in this line of text (you may not be able to see the characters appear as you type them, depending on your version of telnet and local echo settings):
  GET http://www.diamondcs.com.au/portexplorer/spytest.htm HTTP/1.0
 Then press Enter TWICE (one carriage return tells the web-server youve finished sending the current line, two carriage returns in a row tells the web-server that you've finished your request). If you have correctly typed the request, the web-server will respond with data resembling the following (some fields may change):
  HTTP/1.1 200 OK
  Date: Tue, 24 Sep 2002 02:46:13 GMT
  Server: Apache/1.3.22 (Unix) (Red-Hat/Linux) PHP/4.0.5
  Last-Modified: Mon, 23 Sep 2002 17:12:39 GMT
  ETag: "15ea08-64-3d8f4b87"
  Accept-Ranges: bytes
  Content-Length: 100
  Connection: close
  Content-Type: text/html
  <html><title>Port Explorer: Socket Spy Test</title> <body>Hello there, packet-sniffer!</body></html>

Highlighted in light-blue the spytest.htm file data can clearly be seen (and the "Content-Length" field indicates 100 bytes) - we know that the file has transferred correctly!

So now lets see what Port Explorer has captured. Click on the Utilities menu in Port Explorer and select Socket Spy. The Spy List will probably be empty, this is because Port Explorer would've automatically removed the entry for the telnet process when the socket was disconnected from the webserver.

Click on the first packet (#0). You'll see the following single byte in the data window:

The reason we can only see one byte in this packet is because telnet sends each character as it is typed (as opposed to waiting for the user to press enter, and sending all the characters in one packet). The first column in the data window is the byte offset in the packet, the second column is the received data displayed in hexadecimal format, and the third column is the data displayed as text, so here we can clearly see that we have sent "G" - the first key we typed in our GET request.

Now scroll down to the last packet. You'll notice that the second and third last packets both consist of two bytes, with their hex-formatted data showing "0D0A" - this is a carriage return and linefeed, sent by telnet when you pressed Enter. We pressed Enter twice, so there are two such packets. The last packet received is the only packet with "In" as its destination, so we'll select that. It has a large size - several hundred bytes, so we can tell that the web server has sent its response in a single packet. Here is a screen capture of the packet as received by a test machine here at the DiamondCS lab. The actual file in the packet is highlighted using Socket Spy's new-look easy-to-use packet viewer.

We have successfully captured the entire session between the client and server and all packets received have been stored in capture.bin, which we can save to view at a later time.


Socket Spy - Example 2

Socket Spy: Packet-sniffing with Port Explorer

Example 2: Capturing all sent and received data from a process

Right-clicking on a socket in the main Port Explorer window is the most common way to spy on a process/socket, but what if the process you want to spy on hasn't opened any sockets? There's an easy workaround - just manually add the process ID to the spy list! This example will show you how.

To spy on a process, all you need to know is its process ID (PID) - a unique identification number that allows us to specify the exact process we want to spy on. In this example, we'll use Socket Spy to spy on Port Explorer itself (portexplorer.exe), but it could just as easily be any other process.

Finding the process ID is very easy, all you need is a process list utility. For Windows NT/2000/XP users - simply press Ctrl+Alt+Delete to launch Windows Task Manager. You'll see Port Explorer in the list as "portexplorer.ex" (Task Manager restricts the filename size to 15 characters - most other process lists do not have this restriction):

Under the PID column we can clearly see that in this instance the process ID of Port Explorer is 1408. Now that we know the ID of the process, we can tell Socket Spy to start capturing.

Launch Port Explorer if it isn't already started, go to the Utilities menu, then click on Socket Spy. In the small textbox just above the Add PID button, enter the process ID (1408 in this case), and then press the Add PID button:

That's all you need to do. Port Explorer will now capture all sent and received data from all sockets owned by process 1408. To invoke Port Explorer to send data, try using the Whois utility.

To view captured packets simply press the Packet Data radio option. To stop spying on the process, select the process in the list and press the Remove button.


Capture File Format

File Format: capture.bin (Socket Spy Logfile)

This information is provided for programmers.

The capture.bin file (located in your Port Explorer directory if you've used Socket Spy to capture data) is of a simple, custom format, and is documented here for programmers who may wish to make their own capture.bin analysis/viewing programs.

Packets are stored in consecutive order in the capture.bin file, with each packet preceded by a header and filename.

The header is stored with the process filename (with null terminating character) immediately following it, with the captured packet (of size dwBufsize) immediately following the filename, which is in turn followed by the next header and packet, and so on.

C

struct SPYPACKET
{
    DWORD headerID;   //always "SPY_"
     DWORD pid;
    UCHAR sendrecv;   //1 if sending 0 if receive
    UCHAR protocol;
    DWORD localaddr;
    USHORT localport;
    DWORD remoteaddr;
    USHORT remoteport;
    SPYTIME creation; //when this packet was sent/recvd
    USHORT bufsize;   //length of filedata
    USHORT namesize;  //length of filename
    DWORD footerID;   //always 0x12345678
};

struct SPYTIME
{
    unsigned day : 5;       //day from 1-31
    unsigned month : 4;     //month from 1-12
    unsigned year : 6;      //2000 + whatever value in here
    unsigned hour : 5;      //hour from 0-23
    unsigned minute : 6;    //minute from 1-59
    unsigned second : 6;    //second from 1-59
};

SPYPACKET total size 34 bytes


High Performance

DiamondCS Port Explorer has been carefully designed and rigorously tested for maximum stability, reliability and performance.

Stress Tested @ 100mbs/sec
Port Explorer was developed on workstations in a 100mbs/sec Local Area Network and heavily stress tested with flood and packet connections both locally and remotely to ensure stability and reliability.

Reliable & Accurate
Security-related software must show accurate results, this is a prerequisite for any security program. Port Explorer has been designed and tested to ensure maximum reliability and accuracy.

Multi-Threaded Engine
Port Explorer uses an advanced thread control system to maximise the performance of minimal threads to maintain a low background profile. CPU usage typically sits at 0 - 5%, depending on Port Explorer configuration and system hardware.

Small Memory Footprint
Port Explorer was designed to use as little memory as possible, but also comes with a Reduce Memory Usage setting that significantly lowers the memory usage by adjusting Port Explorer's working set size.

Fits on a floppy
Port Explorer is developed in C++ with inline assembly and compiled with optimising compilers so although it's a powerful program with many built-in utilities, it's still small enough to fit on a single 1.44mb floppy disk.


Introduction to Remote Access Trojans

An Introduction to Remote Access Trojans
by Gavin Coe, Senior Analyst - DiamondCS
Remote Access Trojans ("RATs", backdoors) are detected by Port Explorer using exclusive Hidden Server Detection technology. So what exactly is a trojan, and how does it differ from a virus?

Viruses and Worms

Viruses are one of the oldest forms of malicious computer software and were very prevalent in the 80s and 90s, spreading ferociously when users unknowingly swapped infected floppy disks with each other. A virus essentially has two primary objectives - survival, and propagation. It is the goal of the virus to remain alive as long as it can, and infect as many other computers as it can during its lifetime. When the virus is detected and killed, other computers it has infected carry on performing the role of host. Most propagation is carried out when files the virus has infected are transferred by a user from one location to another (usually by floppy disk in the 80s, but usually by email these days).

A worm is a type of virus, but usually these are self contained (the entire file is usually the worm, as opposed to a virus which only resides in a small section of a file) and don't infect other files on the system. However, they often create copies of themselves on a system as backups, again to increase chances of long-term survival.

When a system becomes infected by a virus, things often happen immediately - you may be informed that you are infected by a message or graphic, you may hear funny sounds coming from your PC Speaker, you may see funny visual effects on your screen, or many other effects. Many viruses will cause the system to become unstable if critical files are infected and then don't run correctly (viruses often 'break' files in the process of infecting them, not always intentionally). Most viruses also have a "payload", usually destructive code that is activated after infection. The payload may do things such as delete files, corrupt registry settings, and so on.

Trojans

Trojans are very different to viruses and worms. Destructive trojans do exist (which may delete files or format the computers hard drive, for example), however the most common and powerful type of trojan is known as a Remote Access Trojan (RAT, or backdoor).

A Remote Access Trojan will typically consist of 2 main programs - a server that is placed on the target victims computer, and a client which sends commands to the server. When the server (which is a completely hidden program) is executed on the victims machine, the server starts listening for commands from the client. To do this it will usually open a TCP port (some trojans use UDP but it is not common as UDP is not suitable for file transfer, whereas TCP is). The client can then connect to that port and proceed to issue instructions to the server, which the server then performs.

In the early days of remote access trojans (the mid-to-late 90s), RATs had relatively simple features, such as file transfer options (send file, receive file, send screenshot, etc.), and also some "fun" functions (open/close CD tray, adjust volume, turn microphone/webcam on, send keystrokes, beep, etc.). Today, trojans are capable of anything and every couple of months it seems a new trojan is released that has a new feature that has never before used before. Recent trojan advances include anti-virus/anti-trojan/firewall killing, process hiding, LAN compatibility, and send SMS text notification messages.

Many remote access trojans also come with an EditServer - a utility that allows the hacker to make subtle modifications to the trojan, such as what filename the trojan will use on the victims computer, what port it will listen on, what password it will protect connections with, and so on. This 'configuration' must be saved in the trojan server executable itself - a serious weakness in the design of the trojan. DiamondCS analysts are able to extract the trojan configuration and provide trojan victims with any critical information that was embedded in the configuration, such as the hackers email address, ICQ UIN, mobile phone number, and more. To see which primary trojans can have information extracted from them at the DiamondCS lab, please see this page - http://www.diamondcs.com.au/web/htm/disassembly.php?service=extraction
If you have a trojan not listed on this page that you believe has a configuration built-in, please send it to us and we'll extract it for you.

Why are trojans so dangerous?

Unlike viruses and worms, Remote Access Trojans are human controlled. After gaining access to a system, viruses and worms can't think what to do, at best they can only assess the situation in a pre-programmed manner before performing their primary functions (such as infection, deleting files, etc). In contrast, a human hacker controlling a trojan can make an accurate analysis of the system before taking any action. A human hacker also has the ability to identify particular files of interest (such as files with password or financial information) and can download these quickly. A worm/virus can only steal such information if it knows the exact filename and location (the human hacker knows this from a visual inspection of the file system).

When you become infected by a virus or worm, it is usually quite obvious - strange things might happen, such as increased hard disk activity, a dramatic increase in outbound email, strange visual/audio effects, explicit messages, and so on. However, when you become infected by a trojan it won't be at all obvious. The trojan is hidden - you won't see it on your screen anywhere, you may not even see it in the process list, and it will usually do its best to remain hidden. Generally speaking there are three main types of hackers that are likely to connect to your system:
The curious/explorative hacker - This hacker will browse around your system looking for files of interest and will usually not cause any harm other than data theft.
The malicious hacker - This hacker gets enjoyment at the expense of you and your computer, and can be destructive, annoying, or both. The destructive type may delete files, replace existing programs with broken programs or trojans, or even attempt to format your hard drive. The annoying type may continuously open/close your CD tray, continuously print messages to your printer, send keystrokes (just as if the hacker was typing at the victims keyboard), close/start programs, and more. They could even send email from your address.
The thief hacker - This hacker will try to steal information from your system for illegal personal gain. These people include known criminals and organised crime syndicates, but also 'regular hackers'. They may also use stolen information for identity theft, for example they might send mail to people in your name or attempt to gain access to your bank accounts.

Worms/viruses rarely create backdoors into systems, but trojans do. It only takes one backdoor into a system before a hacker can proceed to upload many trojans to execute on the victims system to create many backdoors, ensuring that even if several trojans are detected and removed, some will probably still survive. This means that after you have been infected with one trojan, you cannot be certain that you haven't been infected with others.

Worms/viruses typically don't attack firewall software, but trojans often do. Trojan authors are continually looking for and finding new ways to evade firewall detection and/or terminate firewall processes, and each new technique seems more insidious than its predecessor. Firewalls cannot be used as the only anti-trojan defence on your system, they must be backed-up by a dedicated anti-trojan program.

Worms/viruses do not spy on victims, trojans do. Key-logging trojans can capture your every keystroke, recording such details as your online banking login/password details, emails, and more, opening the way for identity theft. Trojans can turn on your microphone to record your voice, they can even turn on your webcam to capture you. Trojan data theft is an increasing problem and it is a crime that is quite hard to trace back to the attacker.

Port Explorer vs. Remote Access Trojans

Port Explorer, although not a dedicated anti-trojan system, is designed to help in the detection of Remote Access Trojans (in fact, some technology in Port Explorer was designed for the TDS-4 anti-trojan program) in several ways:
Hidden Server Detection technology shows all hidden servers in red allowing for easy trojan identification
 Port-to-process mapping allows you to see which ports any given process has open
Packet-sniffing with the Socket Spy utility allows you to see what data a process or socket is transferring/receiving
Database of known trojan ports allows you to perform quick searches to see if a particular port number belongs to a known trojan

Hidden Server Detection technology was built for the TDS4 anti-trojan system but is included in Port Explorer. It is a powerful trojan detection method as virtually all known trojans run as hidden servers - programs that use sockets/ports, but don't have any visible components, such as an on-screen window.

Please see the Advanced section in the Port Explorer help manual for comprehensive information regarding Port Explorer's Hidden Server Detection technology.

Anti-virus vs. Remote Access Trojans

Most antivirus software will detect some trojans, usually the most popular ones. Unfortunately, these usually only detect a trojan in its originally distributed form - a real problem because hackers usually modify and customise trojans in many ways before sending them to victims. The simplest modification is to compress the trojan using an 'executable packer' to make the file smaller (the trojan still runs the same). This makes the file contents very different and usually renders the file as undetected by anti-virus scanners.

The main reason for anti-virus scanners failing to strongly detect trojans is that firstly the techniques used to detect viruses and worms are very different to the techniques used to detect trojans, and secondly, anti-virus companies give viruses analysis/detection priority over trojans, whereas it is the other way around with anti-trojan scanning.

TDS - A complete anti-trojan solution

Ever since remote access trojans were conceived in the mid-to-late 1990s, DiamondCS has produced the worlds most powerful trojan detection program - TDS. Designed to overcome all possible ways to disguise trojans, to manipulate and modify trojans. See here for information on TDS, and a free 30 day trial of the current version of TDS: http://tds.diamondcs.com.au

TDS, along with Port Explorer and its ability to show you what is connected to your system and what is using sockets without a window, provides incredibly strong trojan detection capability - we believe it's the best in the world. Experienced TDS users should be able to detect virtually any trojan without any trouble, even if it's a new unknown trojan.

Give it a try today! http://tds.diamondcs.com.au


Problems With Other Port-to-Process Mappers

Problems associated with other port-to-process mappers
(... and how Port Explorer solves them ...)

"Port-to-process mapping" - the ability to determine which processes own which sockets on your system is a seemingly simple process but the underlying techniques are very complicated. For this reason, most of the few port-to-process mappers available today have many problems associated with them - some of them quite serious - that restrict their use and even cause problems with other processes on your system. In designing Port Explorer to be the best possible program of its type from anywhere in the world we had to find a solution to all of these problems - and we did. These problems (and how Port Explorer solves/gets around them) are documented here. This document is not an attack on existing port-to-process mappers, but rather an explanation of the many advances that have been made and hurdles that have been crossed to make Port Explorer the very best program of its kind.

Code Injection
 One port-to-process mapping technique involves code injection, a technique where the mapping process writes writes code into the memory space of all running processes. Code injection is not only an unreliable method (incorrect and missing results can often occur, critical code or data may be overwritten, and many processes can't have code injected into their memory area anyway) but it is also an abused practice (trojans even use it to bypass some personal firewalls) and can have adverse effects on the processes that have been injected, sometimes causing processes to malfunction or crash. In some cases, system instability and even blue-screens-of-death (BSOD) can result. Code injection usually fails on protected system services, and in many cases the code being injected is overwriting existing code. We advise against using such programs on your system for these reasons, or if you do use them then reboot your computer afterwards.
Solved: Port Explorer does not use any code injection techniques.

"Brute-force" Mapping
 Brute-force port-to-process mapping works by repeatedly battering a few select Winsock API's to determine which socket handles are in use by each process (this usually involves code injection first - another problem). It can then determine further information such as local address and port. Brute-forcing is very slow, CPU-intensive, unreliable, and cannot be used to take a 'snapshot' of open ports. In addition, these techniques usually fail on protected system services.
Solved: Port Explorer does not use any brute-force techniques.

Failure to display remote host address/port
 It's one thing for a port-to-process mapper to determine the local address and port of a socket, but surprisingly it usually requires a lot of extra work in order to determine the remote address and port, and in some cases this information isn't available, depending on which techniques are used. Remote host address/port information is very important so it is vital that these details are retrieved and made available to the user.
Solved: Port Explorer is able to show the remote host address and port under all circumstances and conditions.

Slow
 For various reasons, many port-to-process mappers take an extraordinarily long time to display their results - some take several seconds, some even take several minutes!
Solved: Port Explorer is able to retrieve and display results immediately, and it's interface has been optimally designed so that if the list changes are subtle, you probably won't even notice them.

CPU Hog
Many port-to-process mappers (particularly the slower ones) use a lot of CPU when they're executing their mapping routines. This can dramatically slow your system down in some cases and can sometimes cause problems with other applications.
Solved: Port Explorer usually sits on exactly 0% CPU usage, only raising slightly above 0 when executing its main mapping routines (which are optimised to be CPU-efficient).

Only supports a particular version of Windows
Nearly all port-to-process mapping techniques only work on one or two versions of the Windows operating system. For example, if one technique works on Windows 95/98, it usually won't work on any other operating systems. Likewise, if a technique works under Windows XP, it almost certainly won't work under Windows 95/98. For these reasons, most port-to-process mappers only support a particular version of Windows.
Solved: Port Explorer utilises several port-to-process mapping techniques so that it works on virtually all Windows platforms, including Windows 95, 98, 98 SE, ME, NT4, 2K, and XP.

Large program that requires a lot of memory
Some port-to-process mappers are several megabytes in size yet they do a lot less than Port Explorer.
Solved: Port Explorer has been designed and compiled for maximum optimisation and fits on a single floppy disk. Port Explorer uses very little memory, and even comes with a Reduce Memory Usage feature that swaps Port Explorer from memory onto disk.

Doesn't let you kill sockets
There are many times you'll look at the results of a port-to-process mapper and wish to kill/close a socket. Surprisingly, very few port-to-process mappers provide this capability.
Solved: Port Explorer not only lets you kill sockets, it also gives you the unique capability to disable a socket/process's ability to send and/or receive data.

Doesn't show all sockets
Most port-to-process mappers fail to display all sockets on your system (particularly those of protected services), and in some cases inaccurate information is reported.
Solved: Port Explorer accurately reports all sockets open by all processes.

Poor Interface
 Some port-to-process mappers consist of nothing other than a command prompt/console window, making the reported data particularly hard to read and analyse.
Solved: Port Explorer has a highly configurable user-friendly interface that is supported by an iconic menu system and sortable list, allowing you to find the information you're after, quickly..

No realtime reporting
The capability to report in realtime in a log format is very important, especially when you consider that many sockets open and close faster than most port-to-process mappers refresh their display, so realtime traffic reporting is often the only way to be aware of the existance of such sockets.
Solved: Port Explorer has powerful realtime traffic logging capabilities, and data can be logged both to the main Port Explorer window, and to a log file.

Only available with English text
 English is the most common language on the Internet but there are many millions of Internet users who cannot speak or read English very well, if at all. This makes it very hard for non-English speaking users to use the program.
Solved: Port Explorer is the only port-to-process mapper in the world that supports multiple languages, and the language can be switched on the fly. See the Languages page for more information. The iconic menu system also makes it easy to visually identify menu items.

Lack of documentation
 We realise that people using Port Explorer have varied levels of experience with such programs, and that there is nothing more frustrating than not being able to find an answer to your question. Many port-to-process mappers come with little documentation if any at all, leaving the user very much alone and in-the-dark when it comes to help.
Solved: Port Explorer comes with the largest help file of all port-to-process mappers, comprehensively covering all subjects in a way that is easy for all readers to understand. If for some reason the help file fails to answer your question, please see the Support section.

Lack of support
 Many port-to-process mappers are provided "as is" and with no support. This can be particularly frustrating if the program also has lack of documentation, or the documentation doesn't answer your question.
Solved: Port Explorer registered members are entitled to free email support Mon-Fri during business hours - we're here for you. There is also a free public forum where Port Explorer users can discuss issues and questions, see the Port Explorer website for details.


Common Ports

Common Port Numbers and Names

Programs are free to use any port(s) they like, but there are many services that usually use a particular port number. The most common of these are listed here ...

 7     Echo
 Echo servers relay all data received back to their source
17     Quote Of The Day
 Random quote of the day
19     Character Generator
 'CharGen' servers transmit streams of data as soon as a client connects
 20     File Transfer Protocol (FTP) - file transfer
 This port is used by FTP to transfer files
 21     File Transfer Protocol (FTP) - control
 This port is used by FTP to allow the client and server to communicate
23     Telnet
 Telnet is a simple console-style communications protocol
25     Simple Mail Transfer Protocol (SMTP)
 SMTP is the most popular mail transfer protocol on the Internet
43     Whois
 Whois servers contain information about IP and DNS addresses
53     Domain Name Server (DNS)
 DNS translates IP addresses to more human-readable addresses
80     Hypertext Transfer Protocol (HTTP) web server
 HTTP is the protocol used to transfer data on the World Wide Web (WWW)
109    Post Office Protocol (POP)
 POP servers allow you to check your email
110    Post Office Protocol (POP3)
 The most popular version of POP
113    Ident
 Identification protocol, returns info such as system type and username.
119    Network News Transfer Protocol (NNTP)
 The protocol used by newsgroups
135    Remote Procedure Call (RPC)
 Usually the RPC Locator Service, a registrar for all other RPC services
137    NETBIOS Name Service
 Used for local area network address resolution
138    NETBIOS Datagram Service
 Used for local area network UDP transfers
139    NETBIOS Session Service
 Used for local area network TCP transfers
443    Hypertext Transfer Protocol Secure (HTTPS)
 Securely encrypted HTTP web transfer
1080   SOCKS Proxy
 A common proxy server
1433   Microsoft SQL Server
 Microsoft Structured Query Language server
6667   Internet Relay Chat (IRC)
 Internet Relay Chat is a popular text-based chat medium
8080   Proxy
 Commonly used as a proxy for web servers

Red - This port/service is usually only found on Unix/Linux systems.
Blue - This port/service is usually only found on Microsoft Windows systems.
Black - This port/service can be found on multiple operating systems.

Other port numbers

To find out what services use any port number (and vice versa), simply use the Port Explorer Lookup utility.

Other notes

There are 65,535 TCP ports and 65,535 UDP ports.
Most servers allow the admin to choose which port the server will listen on, so for example if you find a server with port 80 open, it doesn't necessarily mean there is a web server at that port..
ICMP doesn't use ports, it works at the same level as Internet Protocol (IP), as seen in this diagram:


Common Ports

Hotkeys - Keyboard Shortcuts

Port Explorer has many keyboard shortcuts that make using Port Explorer faster and easier. These are documented here:

F1

 Help Index
Opens the Port Explorer helpfile (pehelp.chm)

F2

 Pause Display
Pauses/freezes the Port Explorer display

F3

 Disable Sorting
Prevents Port Explorer from sorting data (may improve display speed on slower computers)

Alt+F4

 Exit
Closes/exits the Port Explorer program

F5

 Refresh View
Refreshes the main display

1 - 6

 Change Tab View
Changes which tab has focus (1 to 6, where 1 is All and 6 is Established)

Ctrl+L

 Lookup Utility
Launches the Lookup utility

Ctrl+P

 Ping/Traceroute
Launches the Ping/Traceroute utility

Ctrl+R

 Resolve
Launches the Resolve utility

Ctrl+S

 Socket Spy
Launches the Socket Spy packet-sniffer utility

Ctrl+T

 Statistics
Launches the Statistics utility

Ctrl+W

 Whois
Launches the Whois search utility

A detailed guide to the menu system functions can be found here.


Operating System Specific Notes

Tips & Tricks!

Determine When A Process Was Started
There is a very easy trick to determining when a process started - simply right-click on the process in Port Explorer and select the 'What Is (process)' menu. A dialog will display with the properties of that process. Now, look at the ACCESSED timestamp on the process -- in most cases, this will be the time that the process was started, and is accurate to within 1 second.

Determine Which Process Is Hogging Your Modem
Users on modems may often see their upload light blinking away erratically and wonder 'Which process is sending all that data?'. Port Explorer makes this easy to see - simply ensure that Port Explorer's refresh rate is relatively fast (1-5 seconds is recommended) and then visually browse through the 'Sent' column - what you're looking for is a socket with a Sent count that is continually incrementing. There'll probably only be one that is rising noticeably, this is almost certainly the process that is hogging your modem and sending all that data. To see what data is being sent, simply use the Socket Spy utility.

Preventing A Process From Being Able To Send Data
Preventing a process (or even an individual socket) from being able to send (or receive) data is very easy with Port Explorer -- simply right-click on the process or socket you wish to block, and click on the 'Block Sending' menu from the Socket or Process menu branches.

Slow\restrict the speed of a socket or process
The Bandwidth Throttling capability of Port Explorer allows you to restrict the speed that a socket or process can send and\or receive data - a capability exclusive to Port Explorer. Simply right-click on the socket or process you want to restrict, choose the Socket or Process submenu, then select Max Send Speed or Max Recv Speed.

Closing An Established Connection
Port Explorer gives you the precise ability to terminate/close individual sockets (without affecting or terminating the target program). To close a connection, simply right-click on the socket you wish to close, and select the 'Kill Socket' menu from the Socket menu branch.

Detect which country an IP address belongs to
Port Explorer has automatic IP-to-Country resolving (look in the Country column in the main window), but you can also use this feature on-demand simply by using the Lookup utility (from the Utilities menu), and selecting IP to Country.

Find The Owner Of A Domain
So you've seen a strange connection to your machine from a machine such as 'pc1.xyzhost.com'. This begs the question - who is xyzhost.com, who owns the domain, and who can I contact? The WHOIS utility that comes with Port Explorer makes obtaining this information this very easy. Simply start the Whois utility and do an Automatic Search for xyzhost.com. Within a matter of seconds you'll be presented with owner/contact information about that domain, including an email address to contact.

Sortable Column Headers
A very simple yet powerful feature - Port Explorer's built-in automatic sorting capability allows you to easily sort the data being displayed (ie. from lowest to highest, from newest to oldest, in alphabetical order, etc.). For example, clicking on the Local Port column will cause all data to be shown in the order of the local port corresponding with each socket, showing the ports with the lowest values at the top . Clicking on Local Port again will reverse the order, showing the ports with the lowest values at the bottom. Clicking on the 'Creation' column allows you to easily see the sockets which were most recently created - they'll be at the top of the list. This is a very simple feature yet it makes viewing socket data dramatically easier - take advantage of it!

Interchangeable Column Headers
You can easily change the position/order of the column headers in the main Port Explorer display (such as 'Process', 'ProcessID', 'Protocol' etc.) simply by dragging them with your mouse. For example, if you're not very interested in how many bytes have been sent/received, you may wish to move the 'Sent' and 'Received' columns to the far right. The column orders are automatically remembered by Port Explorer.

Extended Whois Information
The next time you use Port Explorer's Whois utility, change the search from Automatic over to a manual server, such as "Australia (.au)". Enter "help" as the search query, and press the Search button -- the Whois server should return extended information about different ways to query it's database. This allows you to then perform more precise searches. Other queries such as "?" may also work - commands vary from server to server.

Saving/Loading Socket Spy Packet Logs
The data logged by Socket Spy is automatically saved to capture.bin in your Port Explorer directory. You can make a backup of this file at any time you wish, and can also overwrite capture.bin with an existing copy to restore previously-captured data.

Freeze The Port Explorer Display
There may be many times when you use software (not just Port Explorer) that you wish you could freeze the program so that you could take a snapshot, such as a screen capture. Port Explorer makes this easy - simply press F2 (or select 'Pause Display' in the Settings menu), and Port Explorer will stop updating it's display, essentially running in paused mode. Then you can easily make a screen capture or even save the table data by selecting 'Save Table' from the File menu. Pressing F2 again will unfreeze and allow Port Explorer to update the display.

Command Line Options
To use these command line options you must specify them when you start Port Explorer (by modifying the shortcut to Port Explorer, or by implicitly declaring the parameters from the command line).
-m Adding this will make Port Explorer start minimized to the systray as long as you have "Minimize to Systray" option enabled in Port Explorer.
Example: d:\program files\port explorer\portexplorer.exe -m

Log Path
By default, Port Explorer saves the network activity logfile to PELOG.TXT in the Port Explorer directory. You can manually override this by creating a REG_SZ registry value called "Log Path" in HKEY_LOCAL_MACHINE\DIAMOND COMPUTER SYSTEMS\PORT EXPLORER\, the value being the full path to the desired logfile (ie. c:\mypelog.txt)


Frequently Asked Questions

Why does Windows Task Manager show PortExplorer.exe as "PortExplorer.ex"?
On Windows NT and 2000, Windows Task Manager only shows 15 characters for the process filename, and as PortExplorer.exe is 16 characters, the last character is dropped before being displayed. This poses a minor security issue as trojans can intentionally exploit this to give their host file the appearance of another file. Windows XP Task Manager and Port Explorer do not suffer from such a problem and will correctly display all process filenames.

Does Port Explorer inject any code into other processes?
 No, absolutely not. Some other port-to-process mappers do this as it is sometimes possible under the right circumstances for a program to inject code into the memory space of other processes and execute that code, effectively having their own code running as the other process, but Port Explorer does not and will never do this. Code injection is not only an unreliable method (incorrect and missing results can often occur, and many processes can't have code injected into their memory area anyway) but it is also a very dangerous practice (trojans even use it to bypass some personal firewalls) and can have adverse effects on the processes that have been injected, sometimes causing processes to malfunction or crash. In some cases, system instability and even blue-screens-of-death (BSOD) can result. Code injection usually fails on protected system services, and in many cases the code being injected is overwriting existing code. We advise against using such programs on your system for these reasons, or if you do use them then reboot your computer afterwards.

Does Port Explorer patch or modify any files on my computer?
 No. For a full listing of all files that are installed/created by Port Explorer, see this page.

Port Explorer takes a few seconds to load before I see anything, is this normal?
Yes, this is normal. Port Explorer has a complex but important initialisation sequence that will take approximately one second on fast computers, and several seconds on slower computers. Actual performance with Port Explorer running is very fast.

Does Port Explorer suffer from any of the problems that plague most port-to-process mappers?
 No. For a full listing of all problems commonly associated with other port-to-process mappers (and how Port Explorer solves these problems), see this page.

Why does Task Manager show PortExplorer.exe as having lots of page faults?
 A page fault is basically a hardware event that occurs when a process tries to access an address in virtual memory that does not have a location in physical memory associated with it. In response, the system tries to load the appropriate data into a newly assigned physical page. Page faults are completely harmless and virtually all processes on your system will generate page faults at some stage. Port Explorer generates some page faults with every display refresh it invokes (usually every 3 seconds), which is why it will usually have more page faults than 'static' processes.

Please note that page faults are not exclusive to Port Explorer - all programs generate page faults at some stage (as any process viewer such as Windows Task Manager will reveal). Other port-to-process mapping utilities generate page faults at a rate comparable to Port Explorer, and you should find that the rate of page faults generated is directly affected by the refresh rate of the program -- the more refreshes, the more page faults.

 What settings can be adjusted to make Port Explorer run more smoothly on slower computers?
Hide Netstat Sockets - If there are less sockets to display, Port Explorer can update the list more quickly.
Disable Sorting - Sorting requires a lot of calculations. Having it disabled can improve the list display speed.
Refresh Interval - By setting this to a slower value (such as 5 seconds or more) you can improve the performance of Port Explorer.
Show Resolved Addresses - By turning this option off, Port Explorer performance can be improved as it won't try to resolve any addresses.
Pause Display - By pausing the display (F2 keyboard shortcut) you can prevent Port Explorer from updating the list. The list can be manually updated by pressing F5.

What does the TIME_WAIT state mean?
When a socket is closed it goes into a TIME_WAIT state for a certain period (usually 240 seconds). This is to ensure that all the data it has sent has gone through (including the 'FIN' packet to finish the connection), and also to prevent the connection from being re-used and accidentally receiving data meant for the old connection. TIME_WAIT sockets can essentially be ignored by most users.

 Why is Port Explorer listening on a port?
This generally only applies to systems using a proxy service (such as Winsock proxy), such as workstations in a local area network.
Port Explorer doesn't use any socket-opening/listening commands so it is not possible for Port Explorer itself to listen on a socket. However, Port Explorer uses several DNS-related functions (such as gethostbyname() and gethostbyaddr()), that, depending on your system configuration and whether or not you're using a proxy service, may cause a socket or possibly multiple sockets (UDP and/or TCP) to listen for returned DNS responses. If you see Port Explorer listening on any sockets, it is safe to assume they're just open for DNS address resolving.

Why do some processes show as --NETSTAT-- when others display the actual process?
Under Windows 95/98/ME, Port Explorer isn't always able to map all ports back to their parent processes. This is because some of these processes (system services) start before Port Explorer is initialised by the operating system. However, the common "netstat" program can see them, so Port Explorer combines both results into one table, showing the netstat sockets as '--NETSTAT--'.

TIME_WAIT sockets will also often display as --NETSTAT--, as the system has taken ownership of these sockets.

 What do the colors of the sockets (red, black, blue) indicate?
Each color indicates the type of parent process that the socket belongs to. The colors can be altered to your personal preferences, but the default colors are:
Blue - system process. These are processes that normally start as services.
Black - normal process. Most applications will display in this color. Black indicates that the program has at least one visual property, such as a window, that is on-screen.
Red - hidden process. Rare, as this only applies to hidden servers - processes that run invisibly but use sockets (as nearly all remote access trojans do). This is extremely efficient at detecting trojans, but red doesn't necessarily confirm that a process is a trojan. Sockets can also display as red if their parent process has hung or crashed but not yet terminated.
For a further detailed explanation, please see Socket Colors.

 What attributes causes a program to display as a red socket?
Put simply, if Port Explorer determines that the process has no visual properties (eg. no on-screen windows), it will highlight the socket with red text. This is extremely effective in detecting remote access trojans. However, there are a couple of exceptions to the rule:
- System services will display as blue, even if they are invisible (most are). It is possible for a trojan to run as a system service, but this is very rare and not a common trojan practice.
- Programs that have crashed but hanged before completely terminating may have their sockets appear as red, because although the process may still have visual properties on screen such as a dialog window that refuses to close, the process itself has crashed and Port Explorer (or any other program for that matter) will not be able to detect the crashed/hung window.
- System-tray icons do not currently count as a visual property as there is currently no known way to 'map' a system tray icon back to its parent process, as the system tray is handled by explorer.exe. Therefore, programs will show as red if they have a system tray icon but no other visual property.
- Port Explorer uses intelligent algorithms to check the position and size of windows, so windows that are visible but are off-screen will not be counted as a 'visual property.

 I close a socket but it keeps re-opening, why?
Although Port Explorer is successfully able to close most active sockets, it is not possible to prevent the host program from detecting the closure and immediately re-opening the port. If Port Explorer did automatically do this, the host program would go into a never-ending loop where Port Explorer would attempt to terminate the socket, the host program would detect the closure and re-open the socket, and then the loop would start again. Please note that this only works on sockets that are in an ESTABLISHED state.

Can Port Explorer be used as a firewall?
No, Port Explorer is not and can not be used as a firewall. However, Port Explorer does give you control over sockets ability to send and/or receive data, and also lets you close individual sockets.

 Is Port Explorer a packet sniffer?
Port Explorer is not a dedicated packet sniffer, but the advanced Socket Spy utility does give you the unique and powerful capability to packet-capture/spy on individual sockets and processes, allowing you to see data that dedicated packet-sniffers can see but without having to filter through unwanted data. The ability to spy on specific sockets and/or processes is a capability unique to Port Explorer and is explained in detail in the Advanced section of this help manual.

 Do I need to allow Port Explorer access through my personal firewall?
You don't have to, but it is recommended. If you block Port Explorer with your firewall you won't be able to do such things as resolve/traceroute/ping addresses, or use utilities such as the Whois client, but these would be the only restrictions.

If I close the portexplorer.exe program down, is Port Explorer still running?
Yes and no - portexplorer.exe will no longer be running, but dcsws2.dll (the DiamondCS TCP/IP layer) will still be active in a similar way that Winsock and other system services always remains 'active'. However, dcsws2.dll will only be active if at least one process on your system is using TCP/IP.

Are there any known issues with running Port Explorer alongside firewalls, anti-virus or other low-level software?
We aren't aware of any such issues and we don't anticipate any as Port Explorer is very much a standalone program that doesn't interfere with any other programs. If you do suspect a problem, it is highly unlikely that Port Explorer is the cause, but please see the Troubleshooting page for this question:
I think Port Explorer may be causing errors/problems on my system, how can I verify the source of the problem?
The instructions listed will guide you through a simple process that will allow you to pinpoint the cause of the problem. The technique is very useful and can be used to pinpoint the cause of most software problems.


Troubleshooting

See also Frequently Asked Questions

 Many problems not listed on this page can often be resolved simply by uninstalling and (re)installing the latest build of Port Explorer. It is also recommended that you reboot after uninstalling as well as after installing.
There are no sockets - all the lists are empty!
Ensure that dcsws2.dll is correctly registered (see next Troubleshooting question), and ensure that Hide Netstat Sockets isn't turned on (from the Settings menu).

Port Explorer displays error message when loading - "Port Explorer was unable to initialise properly"
dcsws2.dll is not registered. It must reside in your system directory (Windows 95/98) or system32 directory (Windows NT4/2000/XP), it must be registered (using regsvr32.exe), and you must reboot after initially registering it. A required file - sporder.dll - must also reside in the same directory as dcsws2.dll.

Manually register dcsws2.dll
 You can only register dcsws2.dll if it isn't already registered. To ensure that it is unregistered, please follow Manually unregister dcsws2.dll.
To manually register dcsws2.dll -

  1. Ensure that sporder.dll and dcsws2.dll are in the correct Windows system or system32 directory.
  2. Run this command: regsvr32.exe dcsws2.dll (you will see a message informing you if it failed or was successful)
  3. Reboot

Manually unregister dcsws2.dll

  1. Ensure that dcsws2.dll is in the correct Windows system or system32 directory. (sporder.dll is not needed to unregister dcsws2.dll)
  2. Run this command: regsvr32.exe /u dcsws2.dll (you will see a message informing you if it failed or was successful)
  3. Reboot
  4. After rebooting you will be able to delete dcsws2.dll
I think Port Explorer may be causing errors/problems on my system, how can I verify the source of the problem?
It us actually highly unlikely that Port Explorer can cause any errors or problems of any kind on any Windows systems, and extensive international beta testing on virtually all Windows platforms in various nations has concluded that Port Explorer is a highly stable and compatible application that should never cause any problems or trigger any errors of any kind on your Windows system. However, it is easy to confirm whether Port Explorer is the cause of any problem by following this simple procedure:

Keep Port Explorer running for 24 hours or so - do the errors/problems still occur? One-off errors/problems should be ignored as they probably aren't caused by Port Explorer anyway. If the problem is still occurring then uninstall Port Explorer, and continue using your system for another 24 hours. If the problem hasn't gone away, you can be certain the problem isn't related to Port Explorer as it is no longer on your system. However, if the problem has gone away, then re-install Port Explorer. If the problem starts occurring again, it would seem possible that there is an actual problem with Port Explorer on your system, in which case you should contact portexplorer@diamondcs.com.au (please include details about which processes are running on your system, which operating system you're using, and what steps can be performed to replicate the problem).

I changed the language in Port Explorer and now I can't get back to English!
The easiest way is to click on the second menu from the right. You'll know you've selected the correct menu if you see a list of 8 flags - then simply select the language you wish.

Experienced users can manually change to English (or other language) by using a registry editor (such as regedit.exe that comes with Windows), go to the following registry path:
 HKEY_LOCAL_MACHINE\SOFTWARE\Diamond Computer Systems\Port Explorer
Set the value of Language to 2 for English (as English is the second language in the menu list). You can change to other languages by setting 1 for Dutch, 3 for French, 4 for German, 5 for Italian, 6 for Portuguese, 7 for Spanish, and 8 for Swedish.
Caution: Registry editing is not advised. We recommend such changes be made by experienced users only.


System Requirements

See also Operating System Specific Notes

Port Explorer is a highly efficient program in every aspect and should run on all systems that have a 486 (or later) processor with the Microsoft Windows 95 (or later) operating system installed, although Port Explorer gives best results under Windows XP due to new features in the XP operating system. Port Explorer has been carefully designed to use as few resources as possible, as little memory as possible, and the least amount of disk space as possible, and the whole Port Explorer installation program (and even the installed program) can fit onto a single floppy disk.

Minimum Requirements
  • 486 processor (Pentium-class or higher recommended)
  • Microsoft Windows 95, 98, 98SE, 98ME, NT4 (SP4), 2000, XP (2K/XP recommended)
  • 4MB RAM (128MB or higher recommended)
  • 1MB hard-disk space (10MB or higher recommended)
  • 640x480 resolution (800x600 or higher recommended)
  • 256 colors (65536 or higher recommended)
  • Winsock 2

Operating System
Port Explorer has been thoroughly tested in real-world international conditions and is compatible with the following Microsoft® operating systems:

  • Windows 95
  • Windows 95 OSR2
  • Windows 98
  • Windows 98 SE
  • Windows ME
  • Windows NT4 (Service Pack 4 or later)
  • Windows 2000
  • Windows XP
  • Windows 2003

For best results we recommend Windows XP/2003. Please see Operating System Specific Notes for more information. Port Explorer will not run under Windows 3.x (or earlier), Windows NT 3.x, or Windows NT 4 prior to Service Pack 4.

Performance
DiamondCS Port Explorer has been designed for maximum performance and stability. It is multi-threaded and uses as few resources, as little memory, and as little CPU usage as possible, and even provides a feature Port Explorer users can activate that will move Port Explorer from memory onto the hard drive, dramatically reducing memory usage. Laboratory testing to compare Port Explorer to all other commercial port-to-process mapping tools showed that memory usage is nearly always a lot less than those of similar programs under the exact same conditions (running on the same computer, with the same number of sockets in the background, and with the same refresh rate). Port Explorer CPU usage is dramatically less than similar programs, and CPU usage may not even be noticeable unless the refresh rate is on maximum (1 second). Unless Port Explorer is crunching data to update the display it will use virtually no CPU and will sit idle at 0% on most CPU usage monitors such as Windows Task Manager.

If you're using Port Explorer on a particularly slow or over-loaded system, please see the Frequently Asked Questions section for this question:
What settings can be adjusted to make Port Explorer run more smoothly on slower computers?


Operating System Specific Notes

See also System Requirements

Windows 95

Windows 95 users will require Winsock2 to be installed on their system before using Port Explorer. Winsock 2 can be downloaded from Microsoft at this URL:
http://www.microsoft.com/windows95/downloads/contents/wuadmintools/s_wunetworkingtools/w95sockets2/default.asp

Limitations: Windows 95 users will not be able to use the View Statistics feature as this information is not provided by the operating system. The "Kill Socket" feature is also unavailable under Windows 95 as this technique is not supported by the operating system.

Windows NT4

Windows NT4 users will require at least NT4 Service Pack 4 (or later) installed. More information can be obtained from Microsoft at this URL:
http://support.microsoft.com/default.aspx?scid=FH;[LN];ntw40

Windows NT4/2K/XP/2003

Under Windows 95/98 Port Explorer isn't able to map all sockets to their parent process (usually only the ones that are loaded very early by the system). Such processes will normally display with the process name of "--NETSTAT--", indicating that Port Explorer wasn't able to map the process, but it could still see the socket using standard netstat techniques. However, under Windows NT4, 2K, XP and 2003, Port Explorer is able to map ports to all processes by using undocumented functions that are built into the operating system. Sockets that would normally display as '--NETSTAT--' but have been resolved by Port Explorer using this technique will have an asterisk beside their name, for example:
* c:\path\process.exe
 rather than...
c:\path\process.exe

Windows XP/2003

In some rare circumstance, Windows XP doesn't clean up all its sockets correctly after an application has closed. This has the effect of Port Explorer showing a socket with an asterix and no filename because the application is closed yet Windows XP is reporting that the closed application owns the socket(s). Usually after your internet connection has been disconnected the 'blank' socket(s) will be cleaned up by Windows XP. This isn't a Port Explorer problem, it's a Windows XP issue. To check this, whenever you see a blank socket go to your command prompt and type "netstat -ano" (without quotes). You should see the sockets which have the same PID as the blank sockets in Port Explorer. If you look in Windows Task Manager (Ctrl+Alt+Delete | Task Manager) you will see no process that has the PID that netstat and Port Explorer report.


Notes on Service Processes

The Windows NT/2K/XP operating systems support a Win32-based application type known as a Service. There are four ways a Service can be started:
  • At boot time
  • Automatically
  • By a user with the Service Control Manager
  • By a Win32-based application that uses the service-related Win32 APIs

Process-tree viewers under NT/2K/XP that show process owners will show all Services running under services.exe. All applications started by the user or other applications will be shown as running under explorer.exe.

The Service Control subsystem and the associated Win32 APIs are not supported in Windows 95/98/ME. In place of services, Windows 95 has two registry keys that allow users to run applications before a user logs in when the system first starts up. These registry keys are:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
Values under the key RunServicesOnce are deleted after the application is launched.


Glossary

Glossary of Terms

adware - Advertising supported software (adware) is a product that is available for free and in exchange displays advertising banners within the software interface. Instead of you having to pay for the software, the company creates revenue by selling advertising space in the software product. However, some adware will install additional third party components on your system and may exchange statistical data with a remote location over the internet, in which case the adware is also spyware.

byte - Abbreviation for binary term, a unit of storage capable of holding a single character. On almost all modern computers, a byte is equal to 8 bits. Large amounts of memory are indicated in terms of kilobytes (1,024 bytes), megabytes (1,048,576 bytes), and gigabytes (1,073,741,824 bytes).

client - The client part of a client-server architecture. Typically, a client is an application that runs on a personal computer or workstation and relies on a server to perform some operations. For example, an e-mail client is an application that enables you to send and receive email.

dead socket - A socket that has terminated but remains visible in Port Explorer for a pre-specified period of time (3 seconds by default). Dead sockets are usually highlighted with a red background color.

domain - A group of computers and devices on a network that are administered as a unit with common rules and procedures. Within the Internet, domains are defined by the IP address. All devices sharing a common part of the IP address are said to be in the same domain.

DiamondCS - Please visit us on the web at http://www.diamondcs.com.au

honeypot - An Internet-attached server that acts as a decoy, luring in potential hackers in order to study their activities and monitor how they are able to break into a system. Honeypots are designed to mimic systems that an intruder would like to break into but limit the intruder from having access to an entire network. If a honeypot is successful, the intruder will have no idea that s/he is being tricked and monitored. Most honeypots are installed inside firewalls so that they can better be controlled, though it is possible to install them outside of firewalls. A firewall in a honeypot works in the opposite way that a normal firewall works: instead of restricting what comes into a system from the Internet, the honeypot firewall allows all traffic to come in from the Internet and restricts what the system sends back out.

hop - An intermediate connection in a string of connections linking two network devices. On the Internet, for example, most data packets need to go through several routers before they reach their final destination. Each time the packet is forwarded to the next router, a hop occurs. The more hops, the longer it takes for data to go from source to destination. You can see how many hops it takes to get to another Internet host by using the Ping or Traceroute utilities.

ICMP - Short for Internet Control Message Protocol, an extension to the Internet Protocol (IP) defined by RFC 792. ICMP supports packets containing error, control, and informational messages. The ping command, for example, uses ICMP to test an Internet connection.

IP address - An identifier for a computer or device on a TCP/IP network. Networks using the TCP/IP protocol route messages based on the IP address of the destination. The format of an IP address is a 32-bit numeric address written as four numbers separated by periods. Each number can be zero to 255. For example, 1.160.10.240 could be an IP address.

local-area network (LAN) - A computer network that spans a relatively small area. Most LANs are confined to a single building or group of buildings. However, one LAN can be connected to other LANs over any distance via telephone lines and radio waves. A system of LANs connected in this way is called a wide-area network (WAN).

malware - Abbreviation for "malicious software" - any software that contains hostile or malicious code or can disrupt or damage a system.

netstat - A common console program found on most operating systems that allows the user to see a list of the sockets currently in use on the system.

packet - A piece of a message transmitted over a packet-switching network. One of the key features of a packet is that it contains the destination address in addition to the data. In IP networks, packets are often called datagrams.

packet-sniffer - A program and/or device that monitors data traveling over a network. Sniffers can be used both for legitimate network management functions and for stealing information off a network. Unauthorized sniffers can be extremely dangerous to a network's security because they are virtually impossible to detect and can be inserted almost anywhere. This makes them a favorite weapon in the hacker's arsenal.

Ping - A utility to determine whether a specific IP address is accessible. It works by sending a packet to the specified address and waiting for a reply. PING is used primarily to troubleshoot Internet connections. There are many freeware and shareware Ping utilities available for personal computers.

port - In TCP/IP and UDP networks, a port is an endpoint to a logical connection. The port number identifies what type of port it is. For example, port 80 is used for HTTP traffic.

process - An executing program. The term is used loosely as a synonym of task.

process ID - A unique identification number given to every process on your system. You can often run multiple instances of one program, but each instance will have its own unique process ID.

protocol - An agreed-upon format for transmitting data between two devices. Protocols can determine the following: the type of error checking to be used , data compression method (if any), how the sending device will indicate that it has finished sending a message, and how the receiving device will indicate that it has received a message. TCP, UDP, and ICMP are three of the more common protocols used on the Internet and TCP/IP networks.

remote access trojan (RAT) - A common class of modern trojan that uses sockets (usually TCP or UDP) to allow backdoor access into a system.

Resolve - A Port Explorer utility that allows you to resolve IP address to their DNS addresses, and vice versa.

SeDebugPrivilege - SeDebugPrivilege is a privilege level that Port Explorer elevates itself to, allowing it to obtain the process handle of any running application, which is required in order to terminate a process. Without SeDebugPrivilege, many process handles will not be available.

server - The server part of a client-server architecture. Typically, a server is an application that runs on a personal computer or workstation and relies on a client to connect to it to perform some operations. For example, an email server is an application that allows you to connect to it and use it to send email to other people. Most remote access trojans are servers.

socket - A software object that connects an application to a network protocol. For example, a program can send and receive TCP/IP messages by opening a socket and reading and writing data to and from the socket. This simplifies program development because the programmer need only worry about manipulating the socket and can rely on the operating system to actually transport messages across the network correctly. Note that a socket in this sense is completely soft - it's a software object, not a physical component.

spyware - Spyware is any software that covertly gathers user information through the user's Internet connection without his or her knowledge, usually for advertising purposes. Spyware applications are typically bundled as a hidden component of freeware or shareware programs that can be downloaded from the Internet. Once installed, the spyware monitors user activity on the Internet and transmits that information in the background to someone else. Spyware can also gather information about e-mail addresses and even passwords and credit card numbers.

status - The status of the socket at the time of the last display refresh (usually every 1 or 3 seconds).

TCP - Abbreviation of Transmission Control Protocol, and pronounced as separate letters. TCP is one of the main protocols in TCP/IP networks. Whereas the IP protocol deals only with packets, TCP enables two hosts to establish a connection and exchange streams of data. TCP guarantees delivery of data and also guarantees that packets will be delivered in the same order in which they were sent.

TCP/IP - Abbreviation for Transmission Control Protocol/Internet Protocol, the suite of communications protocols used to connect hosts on the Internet. TCP/IP uses several protocols, the two main ones being TCP and IP. TCP/IP is built into the UNIX operating system and is used by the Internet, making it the de facto standard for transmitting data over networks. Even network operating systems that have their own protocols, such as Netware, also support TCP/IP.

TDS - Trojan Defence Suite (also TDS3), the most comprehensive anti-trojan program available for Windows users today. Available at http://tds.diamondcs.com.au

TIME_WAIT - TIME_WAIT is a state that all TCP connections enter into when their connection has been closed. The length of time for this state varies on different operating systems but it's usually 240 seconds, which is to allow for any duplicate segments still in the network from the previous connection to expire.

Traceroute - A utility in Port Explorer that traces a packet from your computer to an Internet host, showing how many hops the packet requires to reach the host and how long each hop takes. If you're visiting a Web site and pages are appearing slowly, you can use traceroute to figure out where the longest delays are occurring. Traceroute utilities work by sending packets with low time-to-live (TTL) fields. The TTL value specifies how many hops the packet is allowed before it is returned. When a packet can't reach its destination because the TTL value is too low, the last host returns the packet and identifies itself. By sending a series of packets and incrementing the TTL value with each successive packet, traceroute finds out who all the intermediary hosts are.

trojan - See remote access trojan.

UDP - Short for User Datagram Protocol, a connectionless protocol that, like TCP, runs on top of IP networks. Unlike TCP/IP, UDP/IP provides very few error recovery services, offering instead a direct way to send and receive datagrams over an IP network. It's used primarily for broadcasting messages over a network.

Winsock - Short for Windows Socket, Winsock is an Application Programming Interface (API) for developing Windows programs that can communicate with other machines via the TCP/IP protocol. Windows 95 and Windows NT comes with Dynamic Link Library (DLL) called winsock.dll that implements the API and acts as the glue between Windows programs and TCP/IP connections. In addition to the Microsoft version of winsock.dll, there are other freeware and shareware versions of winsock.dll. However, there is no official standard for the Winsock API, so each implementation differs in minor ways. Port Explorer requires Winsock 2 to be installed (it is installed by default on most Microsoft Windows systems).

Whois - An Internet utility that returns information about a domain name or IP address. For example, if you enter a domain name such as diamondcs.com.au, whois will return the name and address of the domain's owner.

* Most definitions here are from Webopedia™ - http://www.webopedia.com


Support

Before you contact us for support, please search through this help manual first - your question has probably already been answered!

REGISTERED Port Explorer Users

We pride ourselves on the quality of email support we provide to our registered customers and we happily offer free unconditional email support to registered Port Explorer customers, so if this help manual fails to answer your question or if you just have a comment regarding Port Explorer, please send an email to portexplorer@diamondcs.com.au and importantly please remember to state your license username and serial in the email so that we can help you as fast as possible. Please ensure that your question has not already been answered in this help manual before emailing us - it could save both you and our support staff a lot of time!

UNREGISTERED Port Explorer Users

If you have a comment or question regarding Port Explorer feel free to send it to portexplorer@diamondcs.com.au, we'll do our best to respond (usually within 12 - 48 hours), but please understand if it takes longer..
Port Explorer Forum

You can discuss Port Explorer with other users at the Port Explorer Forum

General Comments, Suggestions, and Bug Reports

General Port Explorer comments, suggestions, and bug reports can be directed to portexplorer@diamondcs.com.au
 Registered users should receive a prompt reply Monday-Friday. Unregistered users usually receive a reply within 48 hours, depending on the workload of our support staff at the time of your enquiry.

Legal Questions

Legal questions can be directed to legal@diamondcs.com.au

Sales Questions

Sales and registration-related questions can be directed to sales@diamondcs.com.au


Useful Links

DiamondCS links
DiamondCS Website - http://www.diamondcs.com.au
Port Explorer Website - http://www.diamondcs.com.au/portexplorer
TDS Anti-Trojan Website - http://tds.diamondcs.com.au

Other Internet Links
NOTE: As these are external Internet links, we have no control over them and they may go down at any time without notice.
Winsock 2 information - http://www.sockets.com/winsock2.htm
The Ping Page - http://www.ping127001.com/pingpage.htm
Netstat @ Microsoft Technet (might word-wrap) - http://www.microsoft.com/technet/treeview/default.asp?url=/TechNet/prodtechnol/winxppro/proddocs/netstat.asp
TCP/IP Resources List - http://www.faqs.org/faqs/internet/tcp-ip/resource-list/
Firewalls FAQ - http://www.faqs.org/faqs/firewalls-faq/
Packet-sniffing FAQ - http://www.robertgraham.com/pubs/sniffing-faq.html
Google Programming Sockets directory - http://directory.google.com/Top/Computers/Programming/Internet/Sockets/


Many Applications In One

Port Explorer - Many applications in one

When you purchase Port Explorer you're not just buying one simple program, but rather several unique and powerful utilities and tools combined into one program that is easy to use yet doesn't sacrifice the flexibility and control that power users demand. If you bought all these applications separately you could easily be paying several hundred dollars, but they all come free with Port Explorer.

Port-to-process mapping (the ability of a program to determine which process is using a particular port/socket) is a capability very few applications in the world can do (there are less than a dozen as of October 2002). Many programs such as netstat allow you to see which ports are in use on your system but they don't let you see which program is using them - this is vital information. Of the few programs that can map ports back to their parent process, Port Explorer is the only one that:
Is compatible with Microsoft Windows 95, 98, 98SE, 98ME, NT4, W2K, and XP
Can capture the packets going through sockets
Highlights hidden servers, a method that detects virtually all known remote access trojans
Can block the ability of a process or socket to send and/or receive data
Has a real-time traffic/network activity log with on-screen and file logging capabilities
Allows you to terminate/close individual sockets and processes
Can report how many bytes have been sent/received by sockets
Can report the exact creation time of the socket
Doesn't inject any code into any processes or files and doesn't touch or modify processes or files in any way
Can detect hidden servers - processes that have no visible on-screen attributes, yet use sockets
Consistently provides accurate results
Supports multiple languages

Whois database searching is a capability usually only found in dedicated standalone Whois clients. These programs can cost up to several hundred dollars yet they offer no extra information that Port Explorer's built-in Whois client can't already access, because the information displayed by a Whois client is provided by remote servers that are beyond the control of the client. Port Explorer's Whois client gives you the capability to send any search query to any Whois server on the planet, giving you 100% unrestricted access to all the Whois databases in the world. Many other Whois clients sacrifice flexibility for ease of use, but Port Explorer's Whois client gives you both ease of use with the Automatic search, and flexibility with manual searching.

We've worked hard to ensure that the Automatic search option in Port Explorer's Whois client is as easy to use and good as if not more powerful than a dedicated Whois client. Lab tests here at DiamondCS show that the Port Explorer Whois utility is able to report Whois database information on virtually all known addresses inputted - no other Whois client we tested performed in this flawless manner. Please note that Whois information is not available for every address, so reporting Whois information on all addresses is not possible, but if information does exist, Port Explorer will find it.

Address-to-geographic-location resolving is a capability that few programs offer. Port Explorer is able to pinpoint the country of a resolved address and displays the geographical location on a world map. Please note that the geographical location is only accurate to within the country - it does not pinpoint cities as there is no accurate and reliable way of doing so. An example of this impossibility is if you take a laptop anywhere in the world and make a long-distance phone call to connect to your regular ISP in your home country. You'll retain your regular IP address just as if you were calling from home, and if anybody attempts to geographically locate your IP address they'll most likely be able to determine that you are in your home city, but they have no way of determining your true geographic location or if you're overseas or not - it's simply not possible using any conventional means.

Packet-sniffer - a program that has the ability to capture and record the data that is sent and received by a socket. There aren't many of these programs in existence, but Port Explorer is one of them. Port Explorer even has an advantage over dedicated packet-sniffers - it can spy on individual processes and even spy on individual sockets, allowing you to home in on the process or socket you want to spy on without capturing all the data from other processes that is constantly being transmitted and received by your system, saving you both time and disk space.

Packet-restrictor - the ability to prevent an individual socket and/or process from sending and/or receiving data. It's a rare ability and the only thing other than Port Explorer that can offer you anything near this capability is your firewall. However, firewalls still do not give you the ability to operate on a single socket as they either apply their rules to an individual port number or individual process, but never individual sockets - this is unique to Port Explorer.

Bandwidth Throttler/Speed Controller - Port Explorer is the only program we know of that has this capability. You can restrict both Send AND Receive speeds on both individual sockets and processes!

Port-killer - the ability to terminate/close an individual socket. Few programs possess this capability, but Port Explorer does and it makes the termination of individual sockets and processes very easy.

Network Traffic Monitor - the ability to show you exactly what network activity is happening on your system as it happens is a very powerful feature of Port Explorer. This capability allows you to easily identify network bottlenecks, isolate unknown and unwanted data transmissions, see which processes are currently busy, and much more!

Netstat - throw that program away! Console applications have many uses, but reporting active connections should not be one of them. There are many freely-available Windows GUI (Graphical User Interface) versions netstat, but even those aren't much better than the netstat console program that comes with most operating systems, and some are over 1 megabyte in size even though they do nothing that the small 25kb netstat.exe doesn't already do!

Even without port-to-process mapping capability, Port Explorer still operates by using the same data that netstat displays. Yet even in this restricted state, Port Explorer can still do what few other GUI netstat programs can:
Terminate/close individual sockets
Terminate individual processes (and acquires powerful SeDebugPrivilege before doing so)
Map all ports back to their host process under XP, even without the DiamondCS TCP/IP layer (dcsws2.dll)
Highlights new and dead sockets for a configurable time period, using configurable highlight colors.
Allows you to sort the displayed data by protocol (TCP, UDP, All), by status (Listening, Established), and by remote address.

Port Explorer gives you an easy-to-understand view of the sockets on your system and allows you to sort and display them in any way you wish - by protocol, creation date, process ID, local port, local address, remote port, remote address, or any other way you wish to sort.

Statistics - your system uses networking all the time, so why doesn't it allow you to view and analyse network statistics? Port Explorer does, so now you'll be able to see every statistic available on your system. Statistics available cover the TCP, UDP, IP, and ICMP protocols.

Search Database - Do you know of any program that would let you know which common programs use a particular port number, or which ports are used by common programs ? Do you know of any program that would let you know what the country code of a particular country is, or what country is referred to by a particular country code ?

Port Explorer's built-in Lookup utility is the easy solution to these questions. Using comprehensive databases that are regularly updated at DiamondCS and freely available to all licensed Port Explorer users, Port Explorer is able to perform cross-searches on ports, services, countries, and country codes.

Ping / Traceroute - don't be fooled by expensive imitations - ping and traceroute are relatively simple programs, both of which are built into Port Explorer. Ping enables you to determine if a remote host is alive, while Traceroute allows you to see the route that is taken by packets sent to the target remote system.


Benefits of registering

There are many incentives to becoming a registered owner of Port Explorer!

When you register DiamondCS Port Explorer, everyone benefits because proceeds from all sales go directly back into DiamondCS research & development, allowing us to build even more powerful software for the International public. However, you get many direct benefits immediately simply by registering, including ...

  • The full-featured registered version of Port Explorer
  • Full access to all Port Explorer features and utilities
  • Access to the exclusive Members Area and members-only downloads
  • Your very own keyfile licensed in your name
  • Free email support
  • Unlimited access to the Port Explorer forum
  • Substantial discounts off future versions
  • Free minor upgrades
  • And much more ...

Registration is easy, join the thousands of users who're empowering themselves with Port Explorer and sign up today!


Pricing

We've tailored the pricing plans of Port Explorer to ensure that home users, educational institutions, registered non-profit organisations and students can all afford to use Port Explorer, whilst ensuring that businesses and network administrators receive substantial discounts on bulk-purchases. Roving "off-site" licenses are also available. IMPORTANT: One license is required for every one computer. You cannot use one license on multiple computers.

The unlimited license for HOME / PERSONAL use allows you to use Port Explorer on ALL machines that you own for personal use, it is fantastic value and gives you no problems in the future with putting Port Explorer on any new computers you get. The single home license can only be used on ONE home/personal computer only.

Before purchasing Port Explorer, please determine which license type best suits you.

Home / Personal |  |  | Business / Educational
 | # Licenses | Price US$ |  | # Licenses | Price US$
 | 1 | $29.95 |  | 1 | $39.95
 | Unlimited | $39.95 |  | 2 | $49.95
 |  |  |  | 3 | $59.95
 |  |  |  | 4 | $69.95
 |  |  |  | 5 | $79.96
 |  |  |  | 25 | $149.95
Roving / Offsite 1 $99each

OR, please select your preferred alternative method of payment ...

Pay online with PayPal
Convenient for new and existing PayPal account-holders


Members Area

The Members Area is an exclusive login-protected area set aside for registered Port Explorer license-holders. Inside, you will find:
  • The full registered version of Port Explorer, ready to download
  • The latest Port Explorer update(s), ready to download
  • Other members-only downloads
  • Your account information
  • Special tips and tricks
  • The gateway to the Port Explorer forum
  • Have your forum questions answered by DiamondCS staff and fellow Port Explorer users
  • And much more that we can't reveal here...

To access the Members Area, registered users can simply click on the Help menu in Port Explorer, then select Members Area. You will need to log in with your email address and serial (these correspond to your license keyfile). Port Explorer will automatically fill in your email address but you'll need to manually enter your serial.

We look forward to seeing you there!


Bulk Licensing

If purchasing more than US$500 worth of licenses you'll need to use direct bank wire transfer to complete the payment.
Please email sales@diamondcs.com.au for more information.


License Types

There are three main license types for Port Explorer:
Home / Personal
 Business / Educational
Roving / Offsite
Before purchasing Port Explorer, please decide which license best suits you.

HOME / PERSONAL LICENSES
These licenses can only be used by home users and registered non-profit organisations. They cannot be used in a business/educational environment.

BUSINESS / EDUCATIONAL LICENSES
These licenses can only be used in the business environment that the keyfile is registered to. They are not for home or personal use and cannot be used outside the business environment.

ROVING/OFF-SITE LICENSES
These licenses can only be used by security consultants, engineers and other off-site/field workers. They are not for office or personal use. Roving/Off-site Licenses are US$99 each, and can be used by one person only. Roving licenses must be uninstalled from client computers before leaving the premises.


Privacy Statement

Privacy Policy

Your privacy comes first.

As the world's leading dedicated anti-trojan company, we here at DiamondCS are proudly committed to bringing the International public quality clean software, and putting your security and confidentiality first in doing so.

In this day and age one unfortunate downside of the Internet is that it allows programs to easily transmit private information indiscriminately, often without the knowledge of the owner of the computer. Many companies are trying and often succeeding in making a lot of money by doing this, but we firmly stand against such practices.

Diamond Computer Systems Pty. Ltd. was established December 15, 1986 - we are the oldest anti-trojan company in the world, our work and our software has been analysed and verified by international experts for decades. Our reputation for quality security software is something we will never risk. Our customers and their privacy and security comes first - always.

When you use DiamondCS software, you can be confident that our software is safe to use, cannot harm your system, and will not invade your privacy. Many programs available on the Internet today resort to questionable practices, but we're proud that our software adheres to the following list:

  • Doesn't monitor any user activity (no "spyware")
  • Doesn't connect out anywhere without the user knowing (no "phone home")
  • Doesn't contain any advertisements (no "adware")
  • Doesn't contain any "hidden nasties" or malicious code of any nature (no "malware")
  • Doesn't compromise any user details
  • Improves and never compromises the security of the system
  • Never stores any personal details
  • Doesn't modify or interfere with any programs or settings on your system
  • Is tamper-resistant to ensure integrity
  • Has a clean and intelligent install and uninstall
  • Doesn't install anything the user doesn't know about

In other words, 100% clean and safe software, and we wouldn't put our name on it if it was any other way.

If you would like to know exactly what is installed on your system when you install Port Explorer, we've declared and documented everything at this Installer page.

All DiamondCS software is made for the International community and proudly built in Australia, a law-abiding and peaceful nation. Our software is subject to the federal laws of the Commonwealth of Australia, but we design our software to meet both Australian, US and International legal requirements. If you have any legal questions please do not hesitate to contact us at legal@diamondcs.com.au


License Agreement

PORT EXPLORER END USER LICENSE AGREEMENT

BY USING THE SOFTWARE ("DiamondCS Port Explorer"), YOU ACCEPT THE TERMS OF THIS AGREEMENT. IF YOU DO NOT BOTH UNDERSTAND AND ACCEPT THE TERMS OF THIS AGREEMENT, YOU ARE NOT AUTHORIZED TO USE THE SOFTWARE AND MUST REMOVE IT FROM YOUR SYSTEM(S).

LICENSED VERSION:
 The full licensed version of Port Explorer, keyfile, license, and serial are not to be sold, distributed, published or otherwise given to anyone. It is available only to registered Port Explorer license-holders.

EVALUATION VERSION:
The evaluation version of Port Explorer has some features disabled. It is not the full version of Port Explorer, and is only available to evaluate Port Explorer. Port Explorer Evaluation version must not be used for more than 15 days, or 30 executions. Port Explorer Evaluation Version must be uninstalled after this period has expired.

INTERNATIONAL:
This computer program is protected by International treaties and copyright law. Unauthorised reproduction or distribution of this program, or any portion of it, may result in severe civil and criminal penalties, and will be prosecuted to the maximum extent possible under law.

GENERAL TERMS:
This is a legal agreement between you (the end user) and Diamond Computer Systems Pty. Ltd. of Perth, Australia (hereafter DCS). By having Port Explorer installed on any computer you own or use, you have agreed to this agreement. If you do not agree to ALL terms and conditions here, you must remove Port Explorer from your computer(s).

USER LICENSE:
DCS grants to you the non-exclusive, non-transferable right to use the software program Port Explorer on any one computer that you own, for every one license that you own. DCS reserves all rights not expressly granted to you.

TERM:
Licensed end users are granted a license to use Port Explorer with no expiry, unless specifically indicated in their keyfile. This license shall be automatically terminated if you breach any of the terms or conditions. Licensed end users are entitled to FREE updates of all Port Explorer binaries and database updates. Purchase is non-refundable after the license has been generated at DCS. DCS reserves the right to terminate the License at any time.

OWNERSHIP OF SOFTWARE:
You can use the software but you do not become an owner of Port Explorer. Ownership and title of Port Explorer at all times is retained by DCS for the original program and any subsequent copies irrespective of the media or form in which they exist.

OWNERSHIP OF KEYFILE:
You can use the Port Explorer keyfile (unlock code) but you do not become an owner of it. Ownership and title of the Port Explorer keyfile is retained by DCS. You may not sell, transfer, publish, distribute, or otherwise give anyone any Port Explorer keyfile(s). DiamondCS reserves the right to terminate keyfile(s) at any time without notice upon their own discretion.

COPYRIGHT:
Port Explorer and any accompanying written materials are copyrighted by DCS. You must include this License Agreement and Copyright Notice in all backup copies of Port Explorer. You may not sell, rent or lease Port Explorer. You may not reverse engineer, recompile, disassemble, or create derivative works from Port Explorer. You may not publish your license in any form. You may keep 1 backup of your keyfile.

ENTIRE LICENSE:
This License sets forth the entire understanding between you and DCS and may be amended only in writing signed by both parties. NO VENDOR, DISTRIBUTOR, DEALER, RETAILER, OR OTHER PERSON IS AUTHORIZED TO MODIFY THIS LICENSE OR TO MAKE ANY WARRANTY, REPRESENTATION OR PROMISE WHICH IS DIFFERENT FROM, OR IN ADDITION TO, THE REPRESENTATIONS OR PROMISES OF THIS LICENSE.

WARRANTY-FREE:
DCS disclaims any warranties concerning works of this copy. DCS has made all attempts to ensure that the quality of this software is of the highest possible, but does not warrant that the software is error free.

NO LIABILITY FOR CONSEQUENTIAL DAMAGES:
In no event shall DCS or its suppliers be liable for consequential, incidental or indirect damages of any kind arising out of the performance or use of the Port Explorer, even if DCS has been advised of the possibility of such damages.


Copyright & Credits

Copyright Information

DiamondCS Port Explorer is Copyright © 2002-2003, Diamond Computer Systems Pty. Ltd.
http://www.diamondcs.com.au

All content in this help manual (textual, graphical or otherwise) is Copyright © 2002-2003, Diamond Computer Systems Pty. Ltd., unless otherwise specified.

Port Explorer uses the IP-to-Country Database provided by Directi (http://directi.com), available from http://ip-to-country.directi.com
The latest Port Explorer compatible version of this database (ip.dat) is available from the Port Explorer Member's Area.

IP-to-Country Database

This program uses the IP-to-Country Database provided by Directi (http://directi.com), available from http://ip-to-country.directi.com

Credits & Acknowledgement

Port Explorer Development Team
Wayne Langlois - Director, design, documentation, security, programming, website, support
Jason Annice - Lead programming, design, graphics, website, installer, documentation, support
Gavin Coe - Testing, bugfixes, design, anti-trojan testing, installer, support

DiamondCS would like to graciously thank our international beta team for their efforts in helping us make Port Explorer the solid, reliable program it is today, Jooske Van Der Burg for her outstanding lead beta testing, and our language translation team for helping to make Port Explorer available to everyone around the world.


Registration

Registering Port Explorer is quick, easy, convenient, and we support a variety of payment options. And best of all, it's a one-off - there are no renewal fees so you can use Port Explorer for years to come, and updates to Port Explorer (including its databases) and email support are available free-of-charge to all registered Port Explorer users. Registered users are also entitled to substantial discounts off future versions.

Price Listing

For detailed pricing information, please see the Pricing Page before placing your order to ensure your order is correct and that you're ordering the correct QUANTITY as well as TYPE of license.

We support several payment options so please scroll down to find the one most suitable for you.

Pay direct to Clickbank

Credit Card or Cheque - Online Secure Web Transaction

Purchasing Port Explorer from Clickbank is very easy, all you'll need is your credit card or chequebook. Clickbank are hosted in the USA and accept Visa, VisaDebit, Mastercard, Mastercard Debit, American Express, Bravo, Discover, Eurocard, and Novus cards, as well as online cheques. To purchase Port Explorer through Clickbank now, click here.

Pay direct to PayPal

PayPal is a very easy and convenient way to shop with DiamondCS. Simply log into your PayPal account (create one if you don't have one yet - it's easy!).
Choose Send Money. PayPal will prompt you for an email address to send your payment to. Our PayPal email address is: sales@diamondcs.com.au

Pay direct to DiamondCS

You can also purchase Port Explorer by paying directly to DiamondCS.

Note to Australian customers:
Australian customers must add 10% for GST to the total purchase price of the order if paying directly to DiamondCS by postal mail, facsimile or direct bank transfer.
GST is not applicable to Australian customers if paying directly to Clickbank or Paypal as these services are hosted in the USA.

We accept Visa, Mastercard, AU/NZ Bankcard, Australia Post money orders, HSBC and Moneygram cheques, fax/postal orders, and bank wire transfers.
For bank wire transfer details, please email admin@diamondcs.com.au

Send your order via Postal Mail, Facsimile, or the Internet

Facsimile
Customers can dispatch their credit-card order to us using a facsimile machine.
IMPORTANT: Please ensure the order form that accompanies Port Explorer is correctly filled out before you fax it to us. The order form can be found in PDF and TXT formats and is in your Port Explorer\Registration directory.
Our fax number is: (+61) 08 9307 3676

Postal Mail
Postal mail is available. Please email sales@diamondcs.com.au for further information

The Internet
Customers can directly dispatch their order to us over the Internet by using the Register (register.exe) program that accompanies Port Explorer. The Register program makes it easy to send your order directly to DiamondCS, and offers stronger security (512-bit RSA) than that offered by your web browser (which is usually 56-to-128-bit). Simply run the program, fill in your credit card details (Visa, Mastercard and AU/NZ Bankcard cards are accepted), then simply press the Send button. If for whatever reason this fails to send your order, simply press the Save button to save your encrypted order to a file. Then simply mail the file to sales@diamondcs.com.au where we will process it.

Important: Fax and postal orders must be accompanied by a Port Explorer order form that has been correctly filled in. The order form can be found in your Port Explorer\Registration directory in both TXT and PDF formats.