How do I find what components within svchost are using what ports?

Using Microsoft's New Port Reporter Tool

Download and unzip the Port Reporter tool from
http://www.microsoft.com/downloads/details.aspx?amp;displaylang=en&familyid=69BA779B-BAE9-4243-B9D6-63E62B4BCD2E&displaylang=en

Unzip it to a folder and run the Pr-Setup.exe program.
Click Start > run >services.msc {enter}
Locate the Port reporter service and double click it, select Start.
Your Ports and the process's using them will now be added to C:\WINDOWS\SYSTEM32\Logfiles\PortReporter in real time listed as follows

PR-INITIAL
The PR-INITIAL log file contains data that the Port Reporter service collects about the ports, processes, and modules that run on the computer when the Port Reporter service is started. The user context that each process is running under is also logged. The following is an example of the contents of a PR-INITIAL log file on a Windows XP-based computer that was created when the Port Reporter service started

The PR-PORTS log file
The PR-PORTS log file contains summary data about TCP and UDP port activity on the computer. The data is listed by using a comma-separated value (csv) format as follows:
date,time,protocol,local port,local IP address,remote port,remote IP address,PID,module,user context

On Windows 2000-based computers that do not support port-to-process mapping, the Port Reporter service lists the data by using the following format:
date,time,protocol,local port,local IP address,remote port,remote IP address

Example
04/6/11,13:15:2,TCP,1029,62.130.153.210,80,64.156.132.140,3312,QuickPost.exe,<TEES-HEALTH\longp>

The PR-PIDS log file
The PR-PIDS log file contains detailed information about ports, processes, related modules, and the user account the process uses to run. The following is an example of the contents of a PR-PIDS log file:

Availability and description of the Port Reporter tool
http://support.microsoft.com/?id=837243

I'd already tried the obvious ones, but they don't help.  From tcpview for example, I can find that the owning process is scvhost.exe, and even which instance of svchost we are talking about - but a single instance of svchost can run multiple services.  Here I have four instances:

svchost.exe                 1012 RpcSs
svchost.exe                 1112 AudioSrv, Browser, CryptSvc, Dhcp, dmserver,
                                 ERSvc, EventSystem,
                                 FastUserSwitchingCompatibility, helpsvc,
                                 Irmon, lanmanserver, lanmanworkstation,
                                 Netman, Nla, RasMan, Schedule, seclogon,
                                 SENS, SharedAccess, ShellHWDetection,
                                 srservice, TapiSrv, TermService, Themes,
                                 TrkWks, uploadmgr, W32Time, winmgmt,
                                 wuauserv, WZCSVC
svchost.exe                 1384 Dnscache
svchost.exe                 1416 LmHosts, RemoteRegistry, SSDPSRV, WebClient

How could I find which service within a particulat instance of svchost actually owns the port?

I'm looking at the docs for the Port Reporter tool.

Port reported looked good but didn't help.  Actually, PortQry (http://support.microsoft.com/default.aspx?kbid=832919) was better.  For the instance PID=1112 above it revealed

PID       Port               Local IP        State                Remote IP:Port
1112    TCP 1025        0.0.0.0         LISTENING        0.0.0.0:32844
1112    TCP 3389        0.0.0.0         LISTENING        0.0.0.0:63498
1112    TCP 3002        127.0.0.1     LISTENING        0.0.0.0:43034
1112    TCP 3003        127.0.0.1     LISTENING        0.0.0.0:8260
1112    UDP 123          127.0.0.1                        *:*
1112    UDP 123          xxx.xxx.xxx.xxx                *:*

(and listed all the services) but not which port belonged to which service.  I really want to go deeper.  Perhap's it's just not possible?

If I am understanding correctly, you want to know which port (if any) is associated to a process

So you can try from a MSDOS windows:

C:\Documents and Settings\Administrador\Escritorio>tasklist /SVC

Nombre de imagen             PID Servicios
========================= ====== =============================================
System Idle Process            0 N/D
System                         4 N/D
smss.exe                     384 N/D
csrss.exe                    440 N/D
winlogon.exe                 464 N/D
services.exe                 508 Eventlog, PlugPlay
lsass.exe                    528 PolicyAgent, ProtectedStorage, SamSs
svchost.exe                  692 RpcSs
svchost.exe                  744 TermService
svchost.exe                  880 Dhcp, Dnscache
svchost.exe                  912 LmHosts
svchost.exe                  940 AudioSrv, BITS, Browser, CryptSvc, dmserver,
                                 EventSystem, helpsvc, lanmanserver,
                                 lanmanworkstation, Netman, Nla, RasMan,
                                 SENS, SharedAccess, ShellHWDetection,
                                 TrkWks, W32Time, winmgmt
spoolsv.exe                 1036 Spooler
msdtc.exe                   1088 MSDTC
svchost.exe                 1196 ERSvc
mdm.exe                     1284 MDM
NscTop.exe                  1312 NSCTOP
nvsvc32.exe                 1512 NVSvc
svchost.exe                 1600 TapiSrv
dfssvc.exe                  1648 Dfs
explorer.exe                2280 N/D
DAP.exe                     2460 N/D
SOUNDMAN.EXE                2476 N/D
ggviewer81-22.exe           2668 N/D
server.exe                  3812 N/D
emule.exe                   3480 N/D
Vision.exe                  5880 N/D
VBI_SE~1.EXE                5492 N/D
TMPGEnc.exe                 3340 N/D
IEXPLORE.EXE                4788 N/D
IEXPLORE.EXE                2620 N/D
IEXPLORE.EXE                2968 N/D
cmd.exe                     3692 N/D
mmc.exe                     2448 N/D
wmiprvse.exe                3796 N/D
wmiprvse.exe                1896 N/D
tasklist.exe                 264 N/D

Now i.e., if you want to know if process with PID 692 (svchost.exe->RpcSs) have associated a port and which is , you can write in a cmd windows:

netstat -ano | find " 692"    (check a space between " 6 )
  TCP    0.0.0.0:135            0.0.0.0:0              LISTENING       692

So the port is 135.

I hope this help you

Kar10s

If you had read the comments you would have realised this doesnt help.  Consider

svchost.exe                  940 AudioSrv, BITS, Browser, CryptSvc, dmserver,
                                 EventSystem, helpsvc, lanmanserver,
                                 lanmanworkstation, Netman, Nla, RasMan,
                                 SENS, SharedAccess, ShellHWDetection,
                                 TrkWks, W32Time, winmgmt

What I want to know is exactly which of the services running under this instance of svchost.exe "owns" each port.

Yes, this queastion could be deleted with points refund as far as I'm concerned.

I had read the comments by my english is not good, so probable I do not undestand completly.But I think that you have not understand me.

No all services open ports.
AudioSrv, Bits, Browser etc, don`t open any tcp/udp ports.

In above example, with this method, you have resolved the most of then. It is only necessary to know:

TCP    0.0.0.0:1026           0.0.0.0:0              LISTENING       940
TCP    127.0.0.1:3002         0.0.0.0:0              LISTENING       940    
TCP    127.0.0.1:3003         0.0.0.0:0              LISTENING       940    
UDP    127.0.0.1:123          *:*                                    940            
UDP    172.16.0.6:123         *:*                                    940            

and they are some of this:

svchost.exe                  940 AudioSrv, BITS, Browser, CryptSvc, dmserver,
                                 EventSystem, helpsvc, lanmanserver,
                                 lanmanworkstation, Netman, Nla, RasMan,
                                 SENS, SharedAccess, ShellHWDetection,
                                 TrkWks, W32Time, winmgmt

You only have to use net start to see which are start of them and net stop/start to know which are them.
 With this method you will know that  

TCP    0.0.0.0:1026            0.0.0.0:0              LISTENING        940  ------------> /lanmanserver
TCP    127.0.0.1:3002         0.0.0.0:0              LISTENING       940    ----------> /SharedAccess
TCP    127.0.0.1:3003         0.0.0.0:0              LISTENING       940    ----------> /sharedAccess
UDP    127.0.0.1:123          *:*                                             940    ----------> /W32Time (std)
UDP    172.16.0.6:123         *:*                                            940     ---------> /W32Time (std)

kar10s

The problem with that approach is that you need to stop each service in turn to see  what changes.  This is OK for a general investigation but no good to diagnose a running system where you dont want to kill things you may need to investigate further.  I was  hoping that somene might know of something which would identify ports open at the thread (or module) level.  This would be much more easly applied in the general case.