Sunday, 12 April 2015

Using Netstat to identify what process has a TCP or UDP port open

There can often be times that you'd like to know what process on your computer is listening on a particular TCP or UDP port.  For example:

  • You have a few different software products on your machine and you do not know which one has a particular port open
  • You are trying to identify malware or spyware on a computer

Short Version
Use netstat -ano to see what processes are associated with different open ports

Long Version
Netstat is a great tool for seeing what TCP or UDP ports are open on a Windows computer - client or server.  The most commonly used netstat -a command will show a list of all ports that are being listened on by the computer.  
However, using netstat -ano will also show the PID (Process ID) that owns each open connection.
netstat -ano
After running this, you can pop over to Task Manager and on the Processes tab you can see what program is being referred to.  Just make sure that you're viewing the PID column.

This is  a great way to identify what process is open and awaiting incoming network connections on your computer - and it's built right into the OS - be it Windows XP, Windows 7, Windows 8 or on the server side - Server 2003, Server 2008 or Server 2012.

No comments:

Post a Comment