14 DAY TRIAL // Have you ever asked yourself what is happening when you open your web browser, type in an address and press enter? Or when you go online through your usual applications, like IM software, online games, antivirus and so on? At that moment you make a request. That signal circulates through a number of internet points (DNS and web servers, gateways, routers, switches) to accomplish what you have asked for, then returns to your application releasing the results for your view (a web page, file download, a loading list, etc.).
This circle is complete in about a few seconds, depending on your bandwidth (the larger the better) or how far you are from the computer where the data you asked for is stored. In other words, the fewer nodes the signal travels, the shorter your waiting time will be.
Microsoft ships its OS with Netstat program, which displays in a text line interface all the opened connections at a certain time. The software I'm going to review today is called TCPView, it is of more help that Netstat and comes with a GUI.
Before continuing, I must say a few words about the developer of this little tool. TCPView was programmed and put to life by Mark Russinovich, which is actually one of the most respected and appreciated experts in "Windows Internals" team. Remember the story with that Sony CDs rootkit? Well, he is the man who discovered that.
TCPView is a reliable networking information tool, it's freeware and displays full information about TCP/UDP endpoints on your PC.
The Transmission Control Protocol (TCP) is the heart of the Internet set of protocols. It is the base on which all the network hosts connect to each other, exchanging the packets. The UDP (User Datagram Protocol) is also a high-level Internet Protocol that uses a direct approach of data connection. With UDP some network applications can save a lot of time, especially if they have small amount of data to exchange.
The program starts into a classic window which consists of a main area (the place where all the processes are listed), the menu and a toolbar with four shortcuts to options that you can also find in the menu. The process list has a header with titles for each column: process, protocol, local address, remote address and state.
The file menu has the whois and close connection options (you can apply these to any of the processes, if available) and the "save/save as" feature that will let you make a text file as a log of your connections.
The next one is the Options menu. It has two important functions of TCPView: show unconnected endpoints and resolve addresses. These two are also to be found in the toolbar of the main window. Through this menu you can set the ?always on top? feature or make some changes for the displaying fonts.
The Process menu enables you to see the properties of each process and put an end to any of them. The View one is the last menu (actually Help is the last one). Here the application has a useful "update speed" of the connections' status (1, 2 or every 5 seconds). You can also set this to pause and update manually whenever you like.
The four shortcuts presented on the toolbar are save (CTRL+S), resolve addresses (CTRL+R), show unconnected endpoints (CTRL+U) and refresh (F5).
The zip file that can be downloaded from the producer contains, besides the TCPView executable, the tcpvcon tool, which displays (text mode) all your connections. The EULA and a help file are to be found in the 85 KB archive (small, isn't it?).
When you open TCPView, and with every update it makes, there can be seen some colored processes. The yellow highlighted endpoints are those which change their status from one update to another. The green ones are the new endpoints. And finally, those in red are the deleted ones.
By right clicking any process you can view its properties or end it, close the connection or launch the whois command. Or you can copy the process' information (e.g. IEXPLORE.EXE:280 TCP softpedia:4369 webs.softpedia.com:http ESTABLISHED)
The good
TCPView shows the name of the application with its opened connections to a remote address. This little program has a "resolve addresses" option, which is useful if you want to see a server internet name beyond its IP (for those you're connected to, of course). The whois option also comes in handy.
The bad
What bad feature should I mention about TCPView? Really, I don't know. I didn't understand if this is a discontinued project or there will be next versions, but I would like to see a future improved graphic part of this network information tool. But that's just my wish.
The truth
TCPView must be your Netstat replacer. It is way too better than this one. If you're into the basic concepts of PC networking then you'll find this graphical tool very useful.
Here are some snapshots of the application in action:
