How do I find which program is using port 80 in Windows? [duplicate]

Question

How do I find which program is using port 80 in Windows?

I can't find it.

Altruism

This question would be better suited for superuser.com – Carnarvon

see How can you find out which process is listening on a port on Windows? – Forefront

so many people are viewing this question and upvoting my answer that I think we should re-consider opening it – Separate

netstat -aof | findstr :80 – Godewyn

@Technotronic: Your answer doesn't say anything not well covered on the question this is a duplicate of, such as https://mcmap.net/q/40397/-how-do-i-find-out-which-process-is-listening-on-a-tcp-or-udp-port-on-windows-closed – Obelia

@BenVoigt and still gets upvotes weekly by people who search for a specific answer and not a generic one. – Separate

@Technotronic: That's not a positive thing. It means twice as much content to maintain. – Obelia

@BenVoigt I think this should be reopened because it's not a duplicate. Port 80 is a special case and the question has not been properly answered. Port 80 will always show PID 4 (System) when ever a process has bound to the HTTP.SYS kernel-mode driver, which is used by many different services like WSMAN or WCF. One would need to use netsh to find the process, and none of the answers here cover that rather common scenario. – Zirconia

@JonC: That sounds like a "Why does HTTP.SYS have port 80 open?" question, since the answer to the question raised here would be HTTP.SYS – Obelia

Answer 1

Start menu → Accessories → right click on "Command prompt". In the menu, click "Run as Administrator" (on Windows XP you can just run it as usual), run netstat -anb, and then look through output for your program.

BTW, Skype by default tries to use ports 80 and 443 for incoming connections.

You can also run netstat -anb >%USERPROFILE%\ports.txt followed by start %USERPROFILE%\ports.txt to open the port and process list in a text editor, where you can search for the information you want.

You can also use PowerShell to parse netstat output and present it in a better way (or process it any way you want):

$proc = @{};
Get-Process | ForEach-Object { $proc.Add($_.Id, $_) };
netstat -aon | Select-String "\s*([^\s]+)\s+([^\s]+):([^\s]+)\s+([^\s]+):([^\s]+)\s+([^\s]+)?\s+([^\s]+)" | ForEach-Object {
    $g = $_.Matches[0].Groups;
    New-Object PSObject |
        Add-Member @{ Protocol =           $g[1].Value  } -PassThru |
        Add-Member @{ LocalAddress =       $g[2].Value  } -PassThru |
        Add-Member @{ LocalPort =     [int]$g[3].Value  } -PassThru |
        Add-Member @{ RemoteAddress =      $g[4].Value  } -PassThru |
        Add-Member @{ RemotePort =         $g[5].Value  } -PassThru |
        Add-Member @{ State =              $g[6].Value  } -PassThru |
        Add-Member @{ PID =           [int]$g[7].Value  } -PassThru |
        Add-Member @{ Process = $proc[[int]$g[7].Value] } -PassThru;
#} | Format-Table Protocol,LocalAddress,LocalPort,RemoteAddress,RemotePort,State -GroupBy @{Name='Process';Expression={$p=$_.Process;@{$True=$p.ProcessName; $False=$p.MainModule.FileName}[$p.MainModule -eq $Null] + ' PID: ' + $p.Id}} -AutoSize
} | Sort-Object PID | Out-GridView

Also it does not require elevation to run.

Sublunary

It'll output too much,but I only want information about port 80 – Altruism

netstat -anb | findstr :80 – Tithable

Then you either need to watch through list carefully or install some additional software. technet.microsoft.com/en-us/sysinternals/bb897437.aspx for example. – Sublunary

Anton, it will chop process names. – Sublunary

@Anton Tykhyy，this way I can't see the programme name,just numbers. – Altruism

Initially (not sure about current situation) Skype was using peer-to-peer connections for calls and chats: this way they don't need huge infrastructure to support millions of clients, so clients attempt to connect directly to each other. Ports 80 and 443 are less likely to be blocked for incoming connections, so they attempt to use it where possible. – Sublunary

Answer 2

Type in the command:

netstat -aon | findstr :80

It will show you all processes that use port 80. Notice the pid (process id) in the right column.

If you would like to free the port, go to Task Manager, sort by pid and close those processes.

-a displays all connections and listening ports.

-o displays the owning process ID associated with each connection.

-n displays addresses and port numbers in numerical form.

Separate

And to find what is the process running it: tasklist /svc /FI "PID eq 1348" (thanks to @Quang-Trinh) – Boddie

netstat -ano ^| findstr "0.0.0.0:80 check Web_Ports_Inspector.bat windowstechinfo.com/2015/05/… – Draco

Is it possible to close the connection? – Sergiosergipe

free the port without killing the process? – Separate

Please note that findstr :80 will match every port INCLUDING "80", so besides port 80, it will also matches programs on port 8009, 8080, etc. – Threedimensional

What to do if PID 4 is listening on :80? "4" is the system, on Windows. – Hazelwood

Answer 3

If you want to be really fancy, download TCPView from Sysinternals:

TCPView is a Windows program that will show you detailed listings of all TCP and UDP endpoints on your system, including the local and remote addresses and state of TCP connections. On Windows Server 2008, Vista, and XP, TCPView also reports the name of the process that owns the endpoint. TCPView provides a more informative and conveniently presented subset of the Netstat program that ships with Windows.

Feverish

Answer 4

Right click on "Command prompt" or "PowerShell", in menu click "Run as Administrator" (on Windows XP you can just run it as usual).

As Rick Vanover mentions in See what process is using a TCP port in Windows Server 2008

The following command will show what network traffic is in use at the port level:

Netstat -a -n -o

or

Netstat -a -n -o >%USERPROFILE%\ports.txt

(to open the port and process list in a text editor, where you can search for information you want)

Then,

with the PIDs listed in the netstat output, you can follow up with the Windows Task Manager (taskmgr.exe) or run a script with a specific PID that is using a port from the previous step. You can then use the "tasklist" command with the specific PID that corresponds to a port in question.

Example:

tasklist /svc /FI "PID eq 1348"

Albite

Answer 5

Use this nifty freeware utility:

CurrPorts is network monitoring software that displays the list of all currently opened TCP/IP and UDP ports on your local computer.

Langtry

Answer 6

Use NETSTAT on the command-line:

netstat util

Pace

This will only display the help text (with all the different options/switches). Which option should be used? Should it be -a - "-a Display All connections and listening ports."? – Plafond

Or -a -n -o? – Plafond