Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. System32
  4. drivers
  5. etc
  6. services
FileRisk: Caution

services C:\Windows\System32\drivers\etc\services

Text file mapping network service names to port numbers and protocols (for example http 80/tcp); read by some tools.

Updated on By AltF4 Formation

What it’s for

Inherited from Unix, services maps a service name (http, smtp, ftp) to a port number and a transport protocol. The sockets APIs (getservbyname, getservbyport) and netstat use it to display names instead of numbers.

What it contains

  • Lines in the form “name port/protocol [alias] [# comment]”, for example http 80/tcp www.
  • A standard list of well-known ports. It does not mean the matching service is active on the machine.

Risks and best practices

  • The file only changes how names are displayed: editing services moves no port that an application actually uses. A change with no reason is therefore more suspect than useful, since the file has no cause to change.
  • Writing requires administrator rights. Keep a copy before touching it, and do not delete it: some tools expect to find it.

Useful commands

Fenêtre de terminal
# Look up a service entry
Select-String -Path "$env:windir\System32\drivers\etc\services" -Pattern '^https\s'


# TCP connections with service names (without -n, netstat resolves ports through this file)
netstat -a -p tcp

Report a mistake