How do I find out which process is listening on a TCP or UDP port on Windows? [closed]

Question

How do I find out which process is listening on a TCP or UDP port on Windows?

Epidaurus

Currports is a tool that helps search + filter too nirsoft.net/utils/cports.html – Coagulum

I ran into this while trying to run Tomcat in debug mode under IntelliJ, the best solution for me turned out to be changing the debug transport configuration (File->Settings->Build/exe/deploy->Debugger) from "socket" to "shared memory". – Ligula

netstat -aof | findstr :8080 (Change 8080 for any port) – Crore

@DavidJesus doesn't show process on windows 10. – Jun

@SmitJohnth I use netstat -aof | findstr :3306 to find the MySQL process on Windows 10 and works like a charm. – Crore

@DavidJesus and for me it doesn't work. Windows 10 too. – Jun

it might be so that your process might be trying to bind to a reserved port. See this answer to find the list of blocked ports: https://mcmap.net/q/40397/-how-do-i-find-out-which-process-is-listening-on-a-tcp-or-udp-port-on-windows-closed – Mat

Yeah, netstat doesnt show process on Windows 7/10. – Sterling

You can also use: netstat -aof | grep :4200 – Slumgullion

A corresponding one for Linux (though probably not the canonical question): Application path and listening port – Pede

@GlennMaynard It is surprising to see user with 50+K reputation that cannot figure out why is this question closed. Closed post notice explains it: question is closed because it is not about programming. It is general computing question that belongs on Super User, not on stack Overflow. – Lancinate

Answer 1

PowerShell

TCP

Get-Process -Id (Get-NetTCPConnection -LocalPort YourPortNumberHere).OwningProcess

UDP

Get-Process -Id (Get-NetUDPEndpoint -LocalPort YourPortNumberHere).OwningProcess

cmd

 netstat -a -b

(Add -n to stop it trying to resolve hostnames, which will make it a lot faster.)

Note Dane's recommendation for TCPView. It looks very useful!

-a Displays all connections and listening ports.

-b Displays the executable involved in creating each connection or listening port. In some cases well-known executables host multiple independent components, and in these cases the sequence of components involved in creating the connection or listening port is displayed. In this case the executable name is in [] at the bottom, on top is the component it called, and so forth until TCP/IP was reached. Note that this option can be time-consuming and will fail unless you have sufficient permissions.

-n Displays addresses and port numbers in numerical form.

-o Displays the owning process ID associated with each connection.

Kurland

and taskkill /PID <pid> to then terminate the process, using /F if appropriate. – Content

You may have to run your command line shell as administrator, otherwise you may get an error message about insufficient privileges. Use the "Run as administrator" option when right-clicking cmd.exe. – Thick

When using -o to show PID, you can then pipe it to grep for the port number (if cygwin or msys installed) as the pid is shown on the same line as opposed to the process name which is shown on a separate line. – Geographical

@BradWilson "-b" is an invalid option please use netstat -a -d – Clayson

@BradWilson and @Clayson It appears netstat's options are not that standard. I had to use netstat -a -n -p. The -b and -d options are not available. The -o option was for timers. The -p options displayed the program name and PID. (on debian 8). – Alkyne

netstat 1.42 (2001-04-15) has no flag -b – Bullington

Having got the PID - let's say it's 1234 - then you can use tasklist /fi "pid eq 1234" to find out the name and other details of the process. – Quoits

On my system, the output from this command, besides being horribly difficult to read due to wrapping, overflowed the command prompt's buffer. I normally prefer command-line tools (although I'm admittedly much more comfortable in a Linux command line than Windows), but in this case, I found the Resource Monitor GUI suggested by @bcorso much more useful. – Conceive

@sebastian_t For the System process (PID 4) there's netsh http show urlacl. It shows system URL reservations. – Elbrus

use | grep :80 is useful for search for specific port. if installed grep. – Phrygian

netstat -a -b overflowed the whole cmd screen. I couldn't find the pid i was looking for before it went away. What i needed was a way to find the port of a specific process using pid. – Diaphragm

PowerShell code doesn't actually work, I get this error: Get-NetTCPConnection : Cannot process argument transformation on parameter 'LocalPort'. Cannot convert value "portNumber" to type "System.UInt16[]". Error: "Cannot convert value "portNumber" to type "System.UInt16". Error: "Input string was not in a correct format."" – Fistula

This doesn't work in PS3.0 - why do windows people never list versions anymore? What powershell version are those commands for? – Huckster

@RodionSychev The powershell command is expecting you to replace "portNumber" with the port number you are looking for. The error states that "portNumber" isn't a number. – Leavings

Also, check the excluded port range on Windows 10 by netsh int ipv4 show excludedportrange protocol=tcp – Albuminous

Having to debug issues with wsl docker-based services and port forwarding rules (served by svchost), and possibility that these rules shadow the binding of some other process, I say that, Resource Monitor is the only one with accurate results (at least on Windows 11 ). – Booher

Answer 2

There's a native GUI for Windows:

• Start menu → All Programs → Accessories → System Tools → Resource Monitor

• or run resmon.exe,

• or from TaskManager → Performance tab.

Abhenry

Also shows the binding's firewall status (last column). Very util. – Bathymetry

You need to be an administrator (or in that group) to run this. – Beore

@bcorso, What does binding to "unspecified address" mean? – Erotomania

Can also be launched from Task Manager's Performance tab, at least in Windows 10. (Have not checked other versions.) – Ramrod

You can also start resource monitor from performance tab of Task Manager by clicking the Open Resource Monitor button. From run prompt perfmon /res command also works to open resource monitor. – Checkrein

The comment of @user4836454 above is NOT correct: Resource Monitor DOES show ports with listeners, even if there is no network connection to these ports. Just look into the section "Listening Ports" instead of the section "TCP Connections". – Adventuresome

This seems to omit some of the TCP ports that are getting used sometimes, even if they're used to the extent that other applications that need them can't start. – Francois

For some reason, the pid i was looking for was not listed in the resource monitor. Had to run the netstat command eventually. – Diaphragm

@Erotomania A single Ethernet interface can have multiple IP addresses assigned to it (usually in servers). 'Unspecified' means that it is listening on the port at any address the server uses. The opposite would be to show the IP address(es) that the program will respond to. – Olodort

@Raphael: Don't you mean 'Tre useful' ? ;) – Scoria

Answer 3

For Windows:

netstat -aon | find /i "listening"

Wiener

+1 But keep in mind, if your windows runs in a language other than english, you will have to change "listening" to the native term. E.g. netstat -aon | find /i "abhören" for german. – Jaws

In my case it didn't work maybe because of quotes sign, but the solution netstat -aon | findstr LISTENING works perfectly! – Lalitta

This works without requiring elevated privileges so upvoted. – Heiner

I'm getting an error while trying to run this command on W10 15063.729 with PowerShell: FIND: Parameter format not correct – Ballinger

Use //i instead of /i if using git bash on windows – Gesundheit

@PawelCioch The OP asks for the process, not the process name – Vortex

Answer 4

Use TCPView if you want a GUI for this. It's the old Sysinternals application that Microsoft bought out.

Triplicate

This is according to me the best option, especially since all processes are in the same list and you can close processes directly by right-clicking them. – Germanous

Also, this doesn't require admin privelges! – Nabila

I love TCPView. It has been my Go-To since windows XP! – Cissy

Answer 5

The -b switch mentioned in most answers requires you to have administrative privileges on the machine. You don't really need elevated rights to get the process name!

Find the pid of the process running in the port number (e.g., 8080)

netstat -ano | findStr "8080"

Find the process name by pid

tasklist /fi "pid eq 2216"

Matabele

Answer 6

You can get more information if you run the following command:

netstat -aon | find /i "listening" |find "port"

using the 'Find' command allows you to filter the results. find /i "listening" will display only ports that are 'Listening'. Note, you need the /i to ignore case, otherwise you would type find "LISTENING". | find "port" will limit the results to only those containing the specific port number. Note, on this it will also filter in results that have the port number anywhere in the response string.

Undefined

FWIW attempting to run this in PowerShell v2.0 yields error FIND: Parameter format not correct. You need to add a space after the find criteria. This will leave you with netstat -aon | find /i "listening" | find "1234 ". – Vanda

Replace "port" above with your port, ex "5000" – Binocular

@Vanda I still get that error with PS 5.1, even after adding the space after the pipe. Do you know what's happening? – Ballinger

@NickeManarinin & @self either first change from powershell to cmd (just type cmd and press enter then redo the command) or in powershell use this command instead: netstat -aon |find /i "{back tick}"listening{back tick}"" |find "{back tick}"port{back tick}"" (<- note the escaped quotes - excuse the term back tick as i cannot add the actual character as it thinks its a snipping) – Handcuff

Answer 7

1. Open a command prompt window (as Administrator) From "Start\Search box" Enter "cmd" then right-click on "cmd.exe" and select "Run as Administrator"

2. Enter the following text then hit Enter.

   netstat -abno

   -a Displays all connections and listening ports.

   -b Displays the executable involved in creating each connection or listening port. In some cases well-known executables host multiple independent components, and in these cases the sequence of components involved in creating the connection or listening port is displayed. In this case the executable name is in [] at the bottom, on top is the component it called, and so forth until TCP/IP was reached. Note that this option can be time-consuming and will fail unless you have sufficient permissions.

   -n Displays addresses and port numbers in numerical form.

   -o Displays the owning process ID associated with each connection.

3. Find the Port that you are listening on under "Local Address"

4. Look at the process name directly under that.

NOTE: To find the process under Task Manager

1. Note the PID (process identifier) next to the port you are looking at.

2. Open Windows Task Manager.

3. Select the Processes tab.

4. Look for the PID you noted when you did the netstat in step 1.

   • If you don’t see a PID column, click on View / Select Columns. Select PID.

   • Make sure “Show processes from all users” is selected.

Wellread

Answer 8

Get PID and Image Name

Use only one command:

for /f "tokens=5" %a in ('netstat -aon ^| findstr 9000') do tasklist /FI "PID eq %a"

where 9000 should be replaced by your port number.

The output will contain something like this:

Image Name                     PID Session Name        Session#    Mem Usage
========================= ======== ================ =========== ============
java.exe                      5312 Services                   0    130,768 K

---

Explanation:

• it iterates through every line from the output of the following command:

  netstat -aon | findstr 9000
  

• from every line, the PID (%a - the name is not important here) is extracted (PID is the 5^th element in that line) and passed to the following command

  tasklist /FI "PID eq 5312"
  

---

If you want to skip the header and the return of the command prompt, you can use:

echo off & (for /f "tokens=5" %a in ('netstat -aon ^| findstr 9000') do tasklist /NH /FI "PID eq %a") & echo on

Output:

java.exe                      5312 Services                   0    130,768 K

Phosphoresce

Good answer, but you should change it tofindstr :9000 if not,you would even find apps what contain the number (e.g. when you search "80" you would find apps on port 80, 800, 8000 too). – Lifeordeath

Answer 9

First we find the process id of that particular task which we need to eliminate in order to get the port free:

Type

netstat -n -a -o

After executing this command in the Windows command line prompt (cmd), select the pid which I think the last column. Suppose this is 3312.

Now type

taskkill /F /PID 3312

You can now cross check by typing the netstat command.

NOTE: sometimes Windows doesn’t allow you to run this command directly on CMD, so first you need to go with these steps:

From the start menu -> command prompt (right click on command prompt, and run as administrator)

Incoordinate

in git bash i had to do taskkill -F -PID 3312 – Ptero

Answer 10

With PowerShell 5 on Windows 10 or Windows Server 2016, run the Get-NetTCPConnection cmdlet. I guess that it should also work on older Windows versions.

The default output of Get-NetTCPConnection does not include Process ID for some reason and it is a bit confusing. However, you could always get it by formatting the output. The property you are looking for is OwningProcess.

• If you want to find out the ID of the process that is listening on port 443, run this command:

    PS C:\> Get-NetTCPConnection -LocalPort 443 | Format-List
  
    LocalAddress   : ::
    LocalPort      : 443
    RemoteAddress  : ::
    RemotePort     : 0
    State          : Listen
    AppliedSetting :
    OwningProcess  : 4572
    CreationTime   : 02.11.2016 21:55:43
    OffloadState   : InHost
  

• Format the output to a table with the properties you look for:

    PS C:\> Get-NetTCPConnection -LocalPort 443 | Format-Table -Property LocalAddress, LocalPort, State, OwningProcess
  
    LocalAddress LocalPort  State OwningProcess
    ------------ ---------  ----- -------------
    ::                 443 Listen          4572
    0.0.0.0            443 Listen          4572
  

• If you want to find out a name of the process, run this command:

    PS C:\> Get-Process -Id (Get-NetTCPConnection -LocalPort 443).OwningProcess
  
    Handles  NPM(K)    PM(K)      WS(K)     CPU(s)     Id  SI ProcessName
    -------  ------    -----      -----     ------     --  -- -----------
    143      15     3448      11024              4572   0 VisualSVNServer
  

Tamra

Answer 11

To get a list of all the owning process IDs associated with each connection:

netstat -ao |find /i "listening"

If want to kill any process have the ID and use this command, so that port becomes free

Taskkill /F /IM PID of a process

Preachy

this doesn't account for listening UDP ports – Greet

Answer 12

It is very simple to get the port number from a PID in Windows.

The following are the steps:

1. Go to run → type cmd → press Enter.

2. Write the following command...

   netstat -aon | findstr [port number]
   

   (Note: Don't include square brackets.)

3. Press Enter...

4. Then cmd will give you the detail of the service running on that port along with the PID.

5. Open Task Manager and hit the service tab and match the PID with that of the cmd, and that's it.

Renner

Answer 13

netstat -aof | findstr :8080 (Change 8080 for any port)

Crore

Answer 14

In case someone need an equivalent for macOS like I did, here is it:

lsof -i tcp:8080

After you get the PID of the process, you can kill it with:

kill -9 <PID>

Complicacy

Yes, but it is tagged with "Windows". The title is "How do I find out which process is listening on a TCP or UDP port on Windows?" – Pede

Related: Find which process is listening on port 8001 on Mac OS X – Pede

Answer 15

To find out which specific process (PID) is using which port:

netstat -anon | findstr 1234

Where 1234 is the PID of your process. [Go to Task Manager → Services/Processes tab to find out the PID of your application.]

Diaphragm

It should be noted that you don't need the -n flag set twice. -ano is enough. – Lonnie

sometimes ports are in use and we need to run these commands: net stop hns net start hns – Mackler

Answer 16

PowerShell

If you want to have a good overview, you can use this:

Get-NetTCPConnection -State Listen | Select-Object -Property *, `
    @{'Name' = 'ProcessName';'Expression'={(Get-Process -Id $_.OwningProcess).Name}} `
    | select ProcessName,LocalAddress,LocalPort

Then you get a table like this:

ProcessName              LocalAddress  LocalPort
-----------              ------------  ---------
services                 ::                49755
jhi_service              ::1               49673
svchost                  ::                  135
services                 0.0.0.0           49755
spoolsv                  0.0.0.0           49672

For UDP, it is:

Get-NetUDPEndpoint | Select-Object -Property *, `
   @{'Name' = 'ProcessName';'Expression'={(Get-Process -Id $_.OwningProcess).Name}} `
   | select ProcessName,LocalAddress,LocalPort

Dato

Answer 17

Just open a command shell and type (saying your port is 123456):

netstat -a -n -o | find "123456"

You will see everything you need.

The headers are:

 Proto  Local Address          Foreign Address        State           PID
 TCP    0.0.0.0:37             0.0.0.0:0              LISTENING       1111

This is as mentioned here.

Somerville

FYI/for anyone interested: It's either findstr 123456 (without quotes) or find "123456" (with quotes). (@Josh) – Gonsalez

this command is not so helpful as netstat -aof | findstr :123456, because it doesn't show process name – Hydrophane

Answer 18

If you'd like to use a GUI tool to do this there's Sysinternals' TCPView.

Matelda

Answer 19

1. Open the command prompt - start → Run → cmd, or start menu → All Programs → Accessories → Command Prompt.

2. Type

   netstat -aon | findstr '[port_number]'
   

Replace the [port_number] with the actual port number that you want to check and hit Enter.

3. If the port is being used by any application, then that application’s detail will be shown. The number, which is shown at the last column of the list, is the PID (process ID) of that application. Make note of this.

4. Type

   tasklist | findstr '[PID]'
   

Replace the [PID] with the number from the above step and hit Enter.

5. You’ll be shown the application name that is using your port number.

Crackup

On Win 10: Your command in step 2 and step 4 does not work unless you replace simple quotes by double quotes. Should say netstat -aon | findstr "[port_number]" – Arun

This solution requires no elevated permission. Tks! – Suffumigate

Answer 20

Netstat:

• -a displays all connection and listening ports
• -b displays executables
• -n stop resolve hostnames (numerical form)

• -o owning process

  netstat -bano | findstr "7002"
  
  netstat -ano > ano.txt 
  

The Currports tool helps to search and filter

Coagulum

Answer 21

Type in the command: netstat -aon | findstr :DESIRED_PORT_NUMBER

For example, if I want to find port 80: netstat -aon | findstr :80

This answer was originally posted to this question.

Rachellerachis

Answer 22

netstat -ao and netstat -ab tell you the application, but if you're not a system administrator you'll get "The requested operation requires elevation".

It's not ideal, but if you use Sysinternals' Process Explorer you can go to specific processes' properties and look at the TCP tab to see if they're using the port you're interested in. It is a bit of a needle and haystack thing, but maybe it'll help someone...

Walloping

If you're not an admin you won't be able to use Process Explorer (or even Windows Task Manager > Resource Manager) to get this info from any process that is not yours to begin with. – Dioxide

Answer 23

Using Windows' default shell (PowerShell) and without external applications

For those using PowerShell, try Get-NetworkStatistics:

> Get-NetworkStatistics | where Localport -eq 8000


ComputerName  : DESKTOP-JL59SC6
Protocol      : TCP
LocalAddress  : 0.0.0.0
LocalPort     : 8000
RemoteAddress : 0.0.0.0
RemotePort    : 0
State         : LISTENING
ProcessName   : node
PID           : 11552

Audit

I don't think it Get-NetworkStatistics is installed as default. It returns me the following: The term 'Get-NetworkStatistics' is not recognized as the name of a cmdlet – Scarcely

@AlejandroSanzDíaz what operating system and build? – Audit

Windows 10 Enterprise 19044.1526 – Scarcely

Answer 24

I recommend CurrPorts from NirSoft.

CurrPorts can filter the displayed results. TCPView doesn't have this feature.

Note: You can right click a process's socket connection and select "Close Selected TCP Connections" (You can also do this in TCPView). This often fixes connectivity issues I have with Outlook and Lync after I switch VPNs. With CurrPorts, you can also close connections from the command line with the "/close" parameter.

Positronium

Answer 25

A single-line solution that helps me is this one. Just substitute 3000 with your port:

$P = Get-Process -Id (Get-NetTCPConnection -LocalPort 3000).OwningProcess; Stop-Process $P.Id

Edit: Changed kill to Stop-Process for more PowerShell-like language

Bim

You probably don't want to kill the process automatically. I would separate that kill command and explain it. Don't want some poor user copy-pasting that without thinking carefully. – Aun

And if you're going for the full PowerShell solution change kill to Stop-Process Get-Process -Id (Get-NetTCPConnection -LocalPort 3000).OwningProcess | Stop-Process – Hammurabi

Answer 26

Follow these tools: From cmd: C:\> netstat -anob with Administrator privileges.

Process Explorer

Process Dump

Port Monitor

All from sysinternals.com.

If you just want to know process running and threads under each process, I recommend learning about wmic. It is a wonderful command-line tool, which gives you much more than you can know.

Example:

c:\> wmic process list brief /every:5

The above command will show an all process list in brief every 5 seconds. To know more, you can just go with /? command of windows , for example,

c:\> wmic /?
c:\> wmic process /?
c:\> wmic prcess list /?

And so on and so forth. :)

Colbycolbye

PortMon (the link behind Port Monitor) is for monitoring serial and parallel ports, not network ports. – Unimposing

Answer 27

Use:

netstat -a -o

This shows the PID of the process running on a particular port.

Keep in mind the process ID and go to Task Manager and services or details tab and end the process which has the same PID.

Thus you can kill a process running on a particular port in Windows.

Tectonics

Answer 28

To find pid who using port 8000

netstat -aon | findstr '8000'

To Kill that Process in windows

taskkill /pid pid /f

where pid is the process id which you get form first command

Sumach

netstat -aon | findstr 8000. quote sign does not need. – Gerhardine

PID is the value returned by the first command in the last column. – Emsmus

Answer 29

You can also check the reserved ports with the command below. Hyper-V reserve some ports, for instance.

netsh int ipv4 show excludedportrange protocol=tcp

Nyaya

Answer 30

Programmatically, you need stuff from iphlpapi.h, for example GetTcpTable2(). Structures like MIB_TCP6ROW2 contain the owner PID.

Gadolinium

Answer 31

Using PowerShell... ...this would be your friend (replace 8080 with your port number):

 netstat -abno | Select-String -Context 0,1 -Pattern 8080

Sample output

>   TCP    0.0.0.0:8080           0.0.0.0:0              LISTENING         2920
   [tnslsnr.exe]
>   TCP    [::]:8080              [::]:0                 LISTENING         2920
   [tnslsnr.exe]

So in this example tnslsnr.exe (OracleXE database) is listening on port 8080.

Quick explanation

• Select-String is used to filter the lengthy output of netstat for the relevant lines.
• -Pattern tests each line against a regular expression.
• -Context 0,1 will output 0 leading lines and 1 trailing line for each pattern match.

Adventuresome

Answer 32

For Windows, if you want to find stuff listening or connected to port 1234, execute the following at the cmd prompt:

netstat -na | find "1234"

Algorism

Answer 33

Use the below batch script which takes a process name as an argument and gives netstat output for the process.

@echo off
set procName=%1
for /f "tokens=2 delims=," %%F in ('tasklist /nh /fi "imagename eq %1" /fo csv') do call :Foo %%~F
goto End

:Foo
set z=%1
echo netstat for : "%procName%" which had pid "%1"
echo ----------------------------------------------------------------------

netstat -ano |findstr %z%
goto :eof

:End

Corporeal

Answer 34

Based on answers with info and kill, for me it is useful to combine them in one command. And you can run this from cmd to get information about process that listen on given port (example 8080):

for /f "tokens=3 delims=LISTENING" %i  in ('netstat -ano ^| findStr "8080" ^| findStr "["') do @tasklist /nh /fi "pid eq %i"

Or if you want to kill it:

for /f "tokens=3 delims=LISTENING" %i  in ('netstat -ano ^| findStr "8080" ^| findStr "["') do @Taskkill /F /IM %i

You can also put those command into a bat file (they will be slightly different - replace %i for %%i):

File portInfo.bat

for /f "tokens=3 delims=LISTENING" %%i  in (
    'netstat -ano ^| findStr "%1" ^| findStr "["'
) do @tasklist /nh /fi "pid eq %%i"

File portKill.bat

for /f "tokens=3 delims=LISTENING" %%i  in (
    'netstat -ano ^| findStr "%1" ^| findStr "["'
) do @Taskkill /F /IM %%i

Then you from cmd you can do this:

portInfo.bat 8080

or

portKill.bat 8080

Cuttler

This might be a useful script. However, I tried it in CMD as well as PowerShell 6 with no luck. Perhaps you could improve your answer by providing a bit more details. – Ratfink

Is the first part working? Is it only problem with "bat"? There are some differences in passing variables: (%%i ) – Cuttler

@Ratfink I have tried this on 3 different Windows 10. For example .\portInfo.bat 800 in PowerShell it give something like this: C:\work>for /F "tokens=3 delims=LISTENING" %i in ('netstat -ano | findStr "800" | findStr "["') do (tasklist /fi "pid eq %i" ) C:\work>(tasklist /fi "pid eq 4" ) Image Name PID Session Name Session# Mem Usage ========================= ======== ================ =========== ============ System 4 Services 0 1,820 K – Cuttler

Sorry, no luck. I put that command into a fiile named portInfo.bat in a powershell terminal, then executed .\portInfo.bat 8080. The output was just the content of the batch file. Very well posslble I'm overlooking something. Note, I'm using PowerShell 6.2.3 on Windows 10. I also tried it in a regular command prompt, but the result was the same: Output of the content of the script. I'm sure I'm missing a crucial piece of information to make this work. – Ratfink

@Ratfink The content of file should be printed, as I showed this in previous commit. Maybe there weren't anything on port 8080. Did you try the first command? And did it return something for this port? for /f "tokens=3 delims=LISTENING" %i in ('netstat -ano ^| findStr "8080" ^| findStr "["') do tasklist /fi "pid eq %i" – Cuttler

Why not add /nh : @tasklist /nh /fi "pid eq %i"? And precisely the door: Findstr ":8080" – Lissa