sded
Premium
join:2002-11-04
San Diego, CA |  [Vista] What is the difference between System Process and System
They both appear in tcpview, System Process at PID0 showing a lot of connections (kernel mode threads?), System at PID4 showing mostly netbios interaction. |
|
dave
Premium,MVM
join:2000-05-04
not in ohio
 ·Verizon Online DSL
| Re: [Vista] What is the difference between System Process and Sy
Neither of those processes run user-mode images, and generally speaking, the "name" displayed for a process is just the name of the image file it's running. So display tools have to make up names: "System" and "System Process" are not good made-up names.
Process Explorer uses "System Idle Process" for pid 0 and "System" for pid 4, which is much better.
Operating systems have to be running some process; the idle process is what gets run when there's nothing else ready to run (there is in fact one thread per processor in the idle process).
The system process is a process that acts as a container for threads created by kernel-mode components - memory management components, drivers, etc.
I don't believe that the idle process (pid 0) ever has any connections. Rather, I think that certain TCP control blocks have their 'ownership' field zeroed out on process termination, meaning no current owner, and TCPview misinterprets that as 'owned by pid 0'. |
|
sded
Premium
join:2002-11-04
San Diego, CA | Thanks a lot; that helps clear up confusion in several places that use different terminology. |
|
