How can you find out which process is listening on a TCP or UDP port on Windows

Question

User · Answer

netstat -ao and netstat -ab tell you the application  but if you re not a system administrator  you ll get  The requested operation requires elevation    It s not ideal  but if you use Sysinternals  Process Explorer you can go to specific processes  properties and look at the TCP tab to see if they re using the port you re interested in  It is a bit of a needle and haystack thing  but maybe it ll help someone

User · Answer

New answer  powershell TCP Get-Process -Id  Get-NetTCPConnection -LocalPort YourPortNumberHere  OwningProcess  UDP Get-Process -Id  Get-NetUDPEndpoint -LocalPort YourPortNumberHere  OwningProcess  Old answer  cmd  C   gt  netstat -a -b   Add -n to stop it trying to resolve hostnames  which will make it a lot faster   Note Dane s recommendation for TCPView  It looks very useful  -a  Displays all connections and listening ports  -b  Displays the executable involved in creating each connection or listening port  In some cases well-known executables host multiple independent components  and in these cases the sequence of components involved in creating the connection        or listening port is displayed  In this case the executable name is in    at the bottom  on top is the component it called  and so forth until TCP IP was reached  Note that this option can be time-consuming and will fail unless you have sufficient permissions  -n  Displays addresses and port numbers in numerical form  -o  Displays the owning process ID associated with each connection

User · Answer

Open a command prompt window  as Administrator  From  Start Search box  Enter  cmd  then right-click on  cmd exe  and select  Run as Administrator  Enter the following text then hit Enter   netstat -abno  -a          Displays all connections and listening ports   -b          Displays the executable involved in creating each connection or             listening port  In some cases well-known executables host             multiple independent components  and in these cases the             sequence of components involved in creating the connection             or listening port is displayed  In this case the executable             name is in    at the bottom  on top is the component it called              and so forth until TCP IP was reached  Note that this option             can be time-consuming and will fail unless you have sufficient             permissions   -n          Displays addresses and port numbers in numerical form   -o          Displays the owning process ID associated with each connection  Find the Port that you are listening on under  Local Address  Look at the process name directly under that    NOTE  To find the process under Task Manager   Note the PID  process identifier  next to the port you are looking at  Open Windows Task Manager   Select the Processes tab   Look for the PID you noted when you did the netstat in step 1    If you don   t see a PID column  click on View   Select Columns  Select PID  Make sure    Show processes from all users    is selected

User · Answer

Just open a command shell and type  saying your port is 123456    netstat -a -n -o   find  123456    You will see everything you need   The headers are    Proto  Local Address          Foreign Address        State           PID  TCP    0 0 0 0 37             0 0 0 0 0              LISTENING       1111   This is as mentioned here

User · Answer

It is very simple to get the port number from a PID in Windows   The following are the steps    Go to run  rarr  type cmd  rarr  press Enter  Write the following command     netstat -aon   findstr  port number     Note  Don t include square brackets   Press Enter    Then cmd will give you the detail of the service running on that port along with the PID  Open Task Manager and hit the service tab and match the PID with that of the cmd  and that s it

User · Answer

For Windows  if you want to find stuff listening or connected to port 1234  execute the following at the cmd prompt    netstat -na   find  1234

User · Answer

To find out which specific process  PID  is using which port   netstat -anon   findstr 1234   Where 1234 is the PID of your process   Go to Task Manager  rarr  Services Processes tab to find out the PID of your application

User · Answer

In case someone need an equivalent for macOS like I did  here is it  lsof -i tcp 8080 After you get the PID of the process  you can kill it with  kill -9  lt PID gt

User · Answer

With PowerShell 5 on Windows 10 or Windows Server 2016  run Get-NetTCPConnection cmdlet  I guess that it should also work on older Windows versions  The default output of Get-NetTCPConnection does not include Process ID by some reason and it is a bit confusing  However  you could always get it by formatting the output  The property you are looking for is OwningProcess   If you want to find out the ID of the process that is listening on port 443  run this command    PS C   gt  Get-NetTCPConnection -LocalPort 443   Format-List    LocalAddress          LocalPort        443   RemoteAddress         RemotePort       0   State            Listen   AppliedSetting     OwningProcess    4572   CreationTime     02 11 2016 21 55 43   OffloadState     InHost   Format the output to a table with the properties you look for    PS C   gt  Get-NetTCPConnection -LocalPort 443   Format-Table -Property LocalAddress  LocalPort  State  OwningProcess    LocalAddress LocalPort  State OwningProcess   ------------ ---------  ----- -------------                      443 Listen          4572   0 0 0 0            443 Listen          4572   If you want to find out a name of the process  run this command    PS C   gt  Get-Process -Id  Get-NetTCPConnection -LocalPort 443  OwningProcess    Handles  NPM K     PM K       WS K      CPU s      Id  SI ProcessName   -------  ------    -----      -----     ------     --  -- -----------   143      15     3448      11024              4572   0 VisualSVNServer

User · Answer

Follow these tools  From cmd  C   gt  netstat -anob with Administrator privileges  Process Explorer Process Dump Port Monitor All from sysinternals com  If you just want to know process running and threads under each process  I recommend learning about wmic  It is a wonderful command-line tool  which gives you much more than you can know  Example  c   gt  wmic process list brief  every 5  The above command will show an all process list in brief every 5 seconds  To know more  you can just go with    command of windows   for example  c   gt  wmic    c   gt  wmic process    c   gt  wmic prcess list     And so on and so forth

User · Answer

You can also check the reserved ports with the command below  Hyper-V reserve some ports  for instance  netsh int ipv4 show excludedportrange protocol tcp

User · Answer

The -b switch mentioned in most answers requires you to have administrative privileges on the machine  You don t really need elevated rights to get the process name   Find the pid of the process running in the port number  e g   8080   netstat -ano   findStr  8080    Find the process name by pid  tasklist  fi  pid eq 2216

User · Answer

Using PowerShell       this would be your friend  replace 8080 with your port number     netstat -abno   Select-String -Context 0 1 -Pattern 8080   Sample output   gt    TCP    0 0 0 0 8080           0 0 0 0 0              LISTENING         2920     tnslsnr exe   gt    TCP         8080                   0                 LISTENING         2920     tnslsnr exe    So in this example tnslsnr exe  OracleXE database  is listening on port 8080   Quick explanation   Select-String is used to filter the lengthy output of netstat for the relevant lines  -Pattern tests each line against a regular expression  -Context 0 1 will output 0 leading lines and 1 trailing line for each pattern match

User · Answer

You can get more information if you run the following command   netstat -aon   find  i  listening   find  port    using the  Find  command allows you to filter the results  find  i  listening  will display only ports that are  Listening   Note  you need the  i to ignore case  otherwise you would type find  LISTENING     find  port  will limit the results to only those containing the specific port number  Note  on this it will also filter in results that have the port number anywhere in the response string

User · Answer

Netstat    -a displays all connection and listening ports -b displays executables -n stop resolve hostnames  numerical form  -o owning process  netstat -bano   findstr  7002   netstat -ano  gt  ano txt     The Currports tool helps to search and filter

User · Answer

Type in the command  netstat -aon   findstr  DESIRED PORT NUMBER  For example  if I want to find port 80  netstat -aon   findstr  80  This answer was originally posted to this question

User · Answer

Use the below batch script which takes a process name as an argument and gives netstat output for the process    echo off set procName  1 for  f  tokens 2 delims      F in   tasklist  nh  fi  imagename eq  1   fo csv   do call  Foo    F goto End   Foo set z  1 echo netstat for     procName   which had pid   1  echo ----------------------------------------------------------------------  netstat -ano  findstr  z  goto  eof   End

User · Answer

A single-line solution that helps me is this one  Just substitute 3000 with your port    P   Get-Process -Id  Get-NetTCPConnection -LocalPort 3000  OwningProcess  Stop-Process  P Id   Edit  Changed kill to Stop-Process for more PowerShell-like language

User · Answer

First we find the process id of that particular task which we need to eliminate in order to get the port free   Type    netstat -n -a -o   After executing this command in the Windows command line prompt  cmd   select the pid which I think the last column  Suppose this is 3312   Now type  taskkill  F  PID 3312   You can now cross check by typing the netstat command   NOTE  sometimes Windows doesn   t allow you to run this command directly on CMD  so first you need to go with these steps   From the start menu -  command prompt  right click on command prompt  and run as administrator

User · Answer

For Windows   netstat -aon   find  i  listening

User · Answer

If you d like to use a GUI tool to do this there s Sysinternals  TCPView

User · Answer

Programmatically  you need stuff from iphlpapi h  for example GetTcpTable2    Structures like MIB TCP6ROW2 contain the owner PID

User · Answer

Use   netstat -a -o   This shows the PID of the process running on a particular port   Keep in mind the process ID and go to Task Manager and services or details tab and end the process which has the same PID   Thus you can kill a process running on a particular port in Windows

User · Answer

Use TCPView if you want a GUI for this  It s the old Sysinternals application that Microsoft bought out

User · Answer

To get a list of all the owning process IDs associated with each connection   netstat -ao  find  i  listening    If want to kill any process have the ID and use this command  so that port becomes free  Taskkill  F  IM PID of a process

User · Answer

Get PID and Image Name  Use only one command   for  f  tokens 5   a in   netstat -aon    findstr 9000   do tasklist  FI  PID eq  a    where 9000 should be replaced by your port number   The output will contain something like this   Image Name                     PID Session Name        Session     Mem Usage                                                                              java exe                      5312 Services                   0    130 768 K     Explanation    it iterates through every line from the output of the following command    netstat -aon   findstr 9000  from every line  the PID   a - the name is not important here  is extracted  PID is the 5th element in that line  and passed to the following command  tasklist  FI  PID eq 5312       If you want to skip the header and the return of the command prompt  you can use   echo off  amp   for  f  tokens 5   a in   netstat -aon    findstr 9000   do tasklist  NH  FI  PID eq  a    amp  echo on   Output   java exe                      5312 Services                   0    130 768 K

User · Answer

There s a native GUI for Windows    Start menu  rarr  All Programs  rarr  Accessories  rarr  System Tools  rarr  Resource Monitor   Or Run resmon exe   or from Task Manager s performance tab

User · Answer

Based on answers with info and kill  for me it is useful to combine them in one command  And you can run this from cmd to get information about process that listen on given port  example 8080   for  f  quot tokens 3 delims LISTENING quot   i  in   netstat -ano    findStr  quot 8080 quot     findStr  quot   quot    do  tasklist  nh  fi  quot pid eq  i quot   Or if you want to kill it  for  f  quot tokens 3 delims LISTENING quot   i  in   netstat -ano    findStr  quot 8080 quot     findStr  quot   quot    do  Taskkill  F  IM  i  You can also put those command into a bat file  they will be slightly different - replace  i for   i   File portInfo bat for  f  quot tokens 3 delims LISTENING quot    i  in        netstat -ano    findStr  quot  1 quot     findStr  quot   quot     do  tasklist  nh  fi  quot pid eq   i quot   File portKill bat for  f  quot tokens 3 delims LISTENING quot    i  in        netstat -ano    findStr  quot  1 quot     findStr  quot   quot     do  Taskkill  F  IM   i  Then you from cmd you can do this  portInfo bat 8080 or portKill bat 8080

User · Answer

netstat -aof   findstr  8080  Change 8080 for any port

User · Answer

I recommend CurrPorts from NirSoft   CurrPorts can filter the displayed results  TCPView doesn t have this feature   Note  You can right click a process s socket connection and select  Close Selected TCP Connections   You can also do this in TCPView   This often fixes connectivity issues I have with Outlook and Lync after I switch VPNs  With CurrPorts  you can also close connections from the command line with the   close  parameter

User · Answer

For those using PowerShell  try Get-NetworkStatistics    gt  Get-NetworkStatistics   where Localport -eq 8000   ComputerName    DESKTOP-JL59SC6 Protocol        TCP LocalAddress    0 0 0 0 LocalPort       8000 RemoteAddress   0 0 0 0 RemotePort      0 State           LISTENING ProcessName     node PID             11552

User · Answer

To find pid who using port 8000 netstat -aon   findstr  8000   To Kill that Process in windows taskkill  pid pid  f  where pid is the process id which you get form first command

User · Answer

Open the command prompt - start  rarr  Run  rarr  cmd  or start menu  rarr  All Programs  rarr  Accessories  rarr  Command Prompt  Type  netstat -aon   findstr   port number      Replace the  port number  with the actual port number that you want to check and hit Enter    If the port is being used by any application  then that application   s detail will be shown  The number  which is shown at the last column of the list  is the PID  process ID  of that application  Make note of this  Type  tasklist   findstr   PID      Replace the  PID  with the number from the above step and hit Enter    You   ll be shown the application name that is using your port number

[windows] How can you find out which process is listening on a TCP or UDP port on Windows?

Examples related to windows

Examples related to networking

Examples related to port