mirror of
https://github.com/ElectronNET/Electron.NET.git
synced 2026-02-03 21:25:13 +00:00
Error: listen EACCES: permission denied 127.0.0.1:8000 #1048
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @DYH1319 on GitHub (Jan 13, 2026).
Steps to Reproduce:
I used the Windows netsh command to obtain a range of ports that, for reasons unknown, have been excluded by Windows, resulting in these ports being unavailable for use:

The GetActiveTcpListeners() method within GetFreePort() cannot retrieve the aforementioned excluded ports.
@DYH1319 commented on GitHub (Jan 14, 2026):
This is a port occupancy issue caused by Hyper-V. I have resolved it by directly executing
netsh int ipv4 set dynamicport tcp start=49152 num=16384. Is it possible to exclude ports occupied by Hyper-V in the Electron.NET source code?@FlorianRappl commented on GitHub (Jan 14, 2026):
No, in general you can always have such an issue - if its not Hyper-V then maybe some other software. We cannot possibly know all software or anything that can run (if we'd go after this we should not open any ports).
I think that the given code is flawed anyway - there is a better mechanism to reliably open a port.
@DYH1319 commented on GitHub (Jan 15, 2026):
Thank you for your response.
The GetFreePort() code provided above is internal to ElectronNet, located at https://github.com/ElectronNET/Electron.NET/blob/main/src/ElectronNET.API/Runtime/Helpers/PortHelper.cs.
It attempts to obtain an available port to serve as the listening port for Electron's socket (line 272 of https://github.com/ElectronNET/Electron.NET/blob/main/src/ElectronNET.Host/main.js#L272).
The port used cannot be modified externally.
Perhaps I didn't say it clearly. The
netsh interface ipv4 show excludedportrange protocol=tcpcommand displays TCP port ranges excluded by the Windows system - not by some software. When Windows hosts software like WSL or Docker Desktop, it may reserve certain ports at the operating system level.However, the current
GetFreePort()method only selects a free port not currently being listened to. I think it's also necessary to choose the port not excluded by the Windows operating system.@FlorianRappl commented on GitHub (Jan 15, 2026):
I think you misread my response.
What I've written is that we should change the
GetFreePortto incl. only available ports (as written "reliably open a port", i.e., select a port that can be reserved and opened) - which means excl. OS occupied ports.@DYH1319 commented on GitHub (Jan 15, 2026):
My apologies for my question. I misread your response.
I can submit a PR to fix this issue.
When the platform is Windows, use Process to execute
netsh interface ipv4 show excludedportrange protocol=tcp, parse the returned results, and apply them as additional exclusion criteria.This is the solution I've devised. Is there a better approach?
@FlorianRappl commented on GitHub (Jan 15, 2026):
Yes (potentially), we can be platform independent by following an approach reading the network interfaces, then just trying to open / use the port. If the port is blocked / refused, then try another one.
A good example is the get-port npm package.
@softworkz commented on GitHub (Jan 15, 2026):
Why would that be required for being platform independent? Anyway, we don't need to deal with multi-homed network configurations. The simple way of port allocation will always open the port on local loopback.
Going through NIs can even be wrong when a port is opened specifically on local loopback only and we are probing a different NI, then the port would be available there - but not on local loopback where we need it.
@softworkz commented on GitHub (Jan 15, 2026):
If we want to do it right, we would anyway need to find a PORT-PAIR rather than a single port, because the Electron side uses port+1.
@FlorianRappl commented on GitHub (Jan 15, 2026):
I am not sure I understand your question. We need to be able to run the code on multiple platforms, i.e., it must be capable not only of Windows, but also on Linux and MacOS.
@softworkz commented on GitHub (Jan 15, 2026):
I know.
Rephrased:
Why would it be required on Linux or MacOS to "read the network interfaces" for opening a port?
@softworkz commented on GitHub (Jan 15, 2026):
Anyway - that's not where the problem lies.
The real problem is that once you have opened a port and closed it, there's no guarantee that you will be able to open it again immediately afterwards.
The way to deal with those situations is to use
setsockopt(SO_REUSEADDRESS). But we cannot set that, because the second opening of the port is done by SocketIOClient - which doesn't set this of course).For those reasons, GetActiveTcpListeners() was the most suitable option, yet - admittedly - I wasn't even aware of those port reservations' existence. Nonetheless, that's where I would put the focus on for fixing (like reading them somehow and adding these to the exclusion list.
@softworkz commented on GitHub (Jan 15, 2026):
Side note: For getting a single free port, you don't do iterations over port numbers. You specify '0' as port and then your socket gets a free port assigned which you can read out then.
@softworkz commented on GitHub (Jan 15, 2026):
I need to go out, so the answer is: It's not needed to use a specific NI to open a port. If you don't do that, the port will be open on all NIs (except for Multicast - in that case it's opened on the default NI only and you need to explicitly bind it on other NIs if you want).
You CAN open a port on a specific NI, but you only do that when you want to open the port on that specific NI - ONLY.
@TANGHULU6 commented on GitHub (Jan 15, 2026):
I agree. Rather than iterating to find a free port, it might be safer to bind to port 0 and read back the port assigned by the OS.
@DYH1319 commented on GitHub (Jan 15, 2026):
This is indeed an issue worth considering.
For Windows platforms, we can simply use the
netsh interface ipv4 show excludedportrange protocol=tcpcommand, parse the output, and add those ports to the exclusion list (I'm not sure if macOS and Linux platforms have excluded ports; in any case, this is the first time I've learned about Windows' excluded ports).Alternatively, we could maintain the current approach: use
TcpListenerto check port availability (ignoring specific network interfaces) while additionally settinglistener.ExclusiveAddressUse = falsebefore startup. This allows the port to be reused for listening (perhaps?).Alternatively, we could let Electron's socket choose its own startup port (by specifying port 0). However, if operating in dotnet first startup mode, this might require monitoring electron's console output or using inter-process communication (or perhaps a better method exists?) to obtain the listening port of electron's socket.
@softworkz commented on GitHub (Jan 15, 2026):
There's an API for this: LookupPersistentTcpPortReservation
No, it does not, for the reasons I mentioned above. ExclusiveAddressUse is exactly doing what I said (just at a higher level than setsockopt()).
It's a bit confusing, though: Windows had traditionally some different behavior, using their own socket option "SO_EXCLUSIVEADDRUSE", which was almost - but not exactly - the opposite of SO_REUSEADDRESS. But later, MS worked towards improving portability and meanwhile, setting the ExclusiveAddressUse property from .NET does no longer set SO_EXCLUSIVEADDRUSE (which still exists), but the internal constant ExclusiveAddressUse (same name es the property).
Here's the definition from the .net source:
ExclusiveAddressUse = ~ReuseAddress,(but anyway, I've come to a somewhat different verdict now...)
@softworkz commented on GitHub (Jan 15, 2026):
Here's my final assessment
After reading a bit and thinking about the case, my conclusion is this:
The case described here is a kind of one-off or a rare anomaly, which is unexpected and normally does not happen like this
The anomaly is not the existence of reserved port ranges - it's about the numeric range within which those reservations have been made. Normally, those reservations are either very targeted (.e.g. IIS reserves ports like 80 and 443 to prevent them from getting hijacked on restart) and specific, but when these are bulk reservations, they are normally made in the ephemeral or at least a rather high range of port numbers.
What the screenshot is showing in the OP is totally unacceptable (if it would be normal). The reservations cover a wide range of well-known ports, many of them officially assigned by IANA. Naturally, a Windows machine must never behave like this, and when we think about this, we suddenly see it very clear when putting it all together:
=> Of course because it normally never happens that reservations are interfering with running applications like this!
As far as I'm seeing it, there's no need to make any change. It goes without saying that it's possible to find a better implementation. But that is a very very tricky subject which can't be accomplished by a quick PR. The devil's in the details and whatever somebody would implement will need careful testing on all platforms.
If someone wants to take a chance on this nonetheless, I would strongly prefer an implementation that doesn't wipe away the current mechanism (I know it's not great - but it's reliable...), and rather builds on top of it - something that comes into effect only in cases when the current method fails.
@softworkz commented on GitHub (Jan 15, 2026):
Almost forgot - for comparison:
@softworkz commented on GitHub (Jan 15, 2026):
On the other hand, if somebody wants do implement the P/Invoke into that Windows API for adding the reservations to the exclusion list - that's totally fine of course (even though I don't think it's necessary).
@DYH1319 commented on GitHub (Jan 16, 2026):
I agree with you. If neither your software (Emby) nor this repository has ever seen user reports of port binding failures, I believe over 99.9% of users won't encounter this issue. Under normal circumstances, Windows shouldn't and won't reserve widely known ports. I should prioritize checking my own computer to find out why these ports are being reserved.
If virtually no one will encounter this problem, I think we don't need to consider it for now—at least until more user report it.
@softworkz commented on GitHub (Jan 16, 2026):
It's probably relatively easy to find out by whom and why they are being reserved, the question is rather why those reservations are being made within in the low range of ports...
While researching, I came across a number of things like registry keys, commands etc. - so there are some things worth exploring, but in the end, it might be just some stupid reason which none of us has on the plate...
Yes, I had thought the same: if there would be another one coming next week (or later), reporting the same issue - then that would turn the situation by 180°.