UDP Port 1037 - what uses it?

[Guest]

I ran portqry on my target device, and it shows UDP 1037 in use, mapped to
svchost.exe. Anybody have any idea which of these svchost-initated services
might use UDP 1037? UDP 123 is NTP, used by w32time.exe.

It does appear that this port is open externally if I run portqry across the
network.

Thanks,
Ann

Process ID: 516 (svchost.exe)

Service Name: CryptSvc
Display Name: Cryptographic Services
Service Type: shares a process with other services

Service Name: dmserver
Display Name: Logical Disk Manager
Service Type: shares a process with other services

Service Name: EventSystem
Display Name: COM+ Event System
Service Type: shares a process with other services

Service Name: HidServ
Display Name: HID Input Service
Service Type: shares a process with other services

Service Name: ShellHWDetection
Display Name: Shell Hardware Detection
Service Type: shares a process with other services

Service Name: Themes
Display Name: Themes
Service Type: shares a process with other services

Service Name: W32Time
Display Name: Windows Time
Service Type: shares a process with other services

Service Name: winmgmt
Display Name: Windows Management Instrumentation
Service Type: shares a process with other services

PID Port Local IP State Remote IPort
516 UDP 1037 0.0.0.0 *:*
516 UDP 123 10.83.32.3 *:*
516 UDP 123 10.99.32.3 *:*
516 UDP 123 127.0.0.1 *:*

Port Statistics

TCP mappings: 0
UDP mappings: 4

 

[Slobodan Brcin \(eMVP\)]

Hi Ann,

Please let us know if you have components "Universal Plug & Play" in your image?
It is a very wild guess and I don't think that this is the cause but it can't hurt you to look.

Regards,
Slobodan

 

[Guest]

No, Universal Plug & Play is not included in the image. Does one of the
services listed below (started by svchost) look like that could be it? Could
w32time be using that port as well?

 

[Slobodan Brcin \(eMVP\)]

Hi Ann,

I do not know :-(
But you can disable them one by one and see for yourself.

Sorry,
Slobodan

 

[KM]

Ann,

How about watching on the traffic for that port? Sometimes a service reports its name in plain text over network.

--
Regards,
KM, BSquare Corp.

PS. I actually did a quick google search and could not find much info on the 1037 port usage. Rather than someone used block for
UPnP on 1037. Some folks were talking about Windows Messenger so check if you have Windows .Net Messenger component.

 

[Guest]

I think that's what I'm going to have to try. Thanks.