How do I find out which process is listening on a TCP or UDP port on Windows?
Mateen Ulhaq
24.7k19 gold badges102 silver badges136 bronze badges
asked Sep 7, 2008 at 6:26
readonlyreadonly
344k107 gold badges204 silver badges205 bronze badges
11
PowerShell
TCP
Get-Process -Id (Get-NetTCPConnection -LocalPort YourPortNumberHere).OwningProcess
UDP
Get-Process -Id (Get-NetUDPEndpoint -LocalPort YourPortNumberHere).OwningProcess
cmd
netstat -a -b
(Add -n to stop it trying to resolve hostnames, which will make it a lot faster.)
Note Dane’s recommendation for TCPView. It looks very useful!
-a Displays all connections and listening ports.
-b Displays the executable involved in creating each connection or listening port. In some cases well-known executables host multiple independent components, and in these cases the sequence of components involved in creating the connection or listening port is displayed. In this case the executable name is in [] at the bottom, on top is the component it called, and so forth until TCP/IP was reached. Note that this option can be time-consuming and will fail unless you have sufficient permissions.
-n Displays addresses and port numbers in numerical form.
-o Displays the owning process ID associated with each connection.
answered Sep 7, 2008 at 6:28
15
There’s a native GUI for Windows:
-
Start menu → All Programs → Accessories → System Tools → Resource Monitor
-
or run
resmon.exe
, -
or from TaskManager → Performance tab.
serge
14.1k35 gold badges124 silver badges206 bronze badges
answered May 18, 2014 at 5:02
bcorsobcorso
45.7k10 gold badges63 silver badges76 bronze badges
10
For Windows:
netstat -aon | find /i "listening"
xash
3,70210 silver badges22 bronze badges
answered Sep 7, 2008 at 6:32
akuaku
122k32 gold badges174 silver badges203 bronze badges
6
Use TCPView if you want a GUI for this. It’s the old Sysinternals application that Microsoft bought out.
answered Sep 7, 2008 at 6:38
DaneDane
9,7375 gold badges28 silver badges23 bronze badges
3
The -b switch mentioned in most answers requires you to have administrative privileges on the machine. You don’t really need elevated rights to get the process name!
Find the pid of the process running in the port number (e.g., 8080)
netstat -ano | findStr "8080"
Find the process name by pid
tasklist /fi "pid eq 2216"
Jaywalker
3,0793 gold badges29 silver badges44 bronze badges
answered Jan 24, 2018 at 3:50
Ram SharmaRam Sharma
2,4971 gold badge8 silver badges7 bronze badges
You can get more information if you run the following command:
netstat -aon | find /i "listening" |find "port"
using the ‘Find’ command allows you to filter the results. find /i "listening"
will display only ports that are ‘Listening’. Note, you need the /i
to ignore case, otherwise you would type find «LISTENING». | find "port"
will limit the results to only those containing the specific port number. Note, on this it will also filter in results that have the port number anywhere in the response string.
answered Oct 8, 2013 at 18:56
Nathan24Nathan24
1,3721 gold badge11 silver badges20 bronze badges
4
-
Open a command prompt window (as Administrator) From «Start\Search box» Enter «cmd» then right-click on «cmd.exe» and select «Run as Administrator»
-
Enter the following text then hit Enter.
netstat -abno
-a Displays all connections and listening ports.
-b Displays the executable involved in creating each connection or
listening port. In some cases well-known executables host
multiple independent components, and in these cases the
sequence of components involved in creating the connection
or listening port is displayed. In this case the executable
name is in [] at the bottom, on top is the component it called,
and so forth until TCP/IP was reached. Note that this option
can be time-consuming and will fail unless you have sufficient
permissions.-n Displays addresses and port numbers in numerical form.
-o Displays the owning process ID associated with each connection.
-
Find the Port that you are listening on under «Local Address»
-
Look at the process name directly under that.
NOTE: To find the process under Task Manager
-
Note the PID (process identifier) next to the port you are looking at.
-
Open Windows Task Manager.
-
Select the Processes tab.
-
Look for the PID you noted when you did the netstat in step 1.
-
If you don’t see a PID column, click on View / Select Columns. Select PID.
-
Make sure “Show processes from all users” is selected.
-
answered Nov 8, 2012 at 1:49
CyborgCyborg
1,24412 silver badges12 bronze badges
Get PID and Image Name
Use only one command:
for /f "tokens=5" %a in ('netstat -aon ^| findstr 9000') do tasklist /FI "PID eq %a"
where 9000
should be replaced by your port number.
The output will contain something like this:
Image Name PID Session Name Session# Mem Usage
========================= ======== ================ =========== ============
java.exe 5312 Services 0 130,768 K
Explanation:
-
it iterates through every line from the output of the following command:
netstat -aon | findstr 9000
-
from every line, the PID (
%a
— the name is not important here) is extracted (PID is the5
th element in that line) and passed to the following commandtasklist /FI "PID eq 5312"
If you want to skip the header and the return of the command prompt, you can use:
echo off & (for /f "tokens=5" %a in ('netstat -aon ^| findstr 9000') do tasklist /NH /FI "PID eq %a") & echo on
Output:
java.exe 5312 Services 0 130,768 K
answered Feb 10, 2016 at 10:17
ROMANIA_engineerROMANIA_engineer
54.6k29 gold badges203 silver badges200 bronze badges
1
First we find the process id of that particular task which we need to eliminate in order to get the port free:
Type
netstat -n -a -o
After executing this command in the Windows command line prompt (cmd), select the pid which I think the last column. Suppose this is 3312.
Now type
taskkill /F /PID 3312
You can now cross check by typing the netstat
command.
NOTE: sometimes Windows doesn’t allow you to run this command directly on CMD, so first you need to go with these steps:
From the start menu -> command prompt (right click on command prompt, and run as administrator)
answered Aug 23, 2014 at 15:25
1
With PowerShell 5 on Windows 10 or Windows Server 2016, run the Get-NetTCPConnection
cmdlet. I guess that it should also work on older Windows versions.
The default output of Get-NetTCPConnection
does not include Process ID for some reason and it is a bit confusing. However, you could always get it by formatting the output. The property you are looking for is OwningProcess
.
-
If you want to find out the ID of the process that is listening on port 443, run this command:
PS C:\> Get-NetTCPConnection -LocalPort 443 | Format-List LocalAddress : :: LocalPort : 443 RemoteAddress : :: RemotePort : 0 State : Listen AppliedSetting : OwningProcess : 4572 CreationTime : 02.11.2016 21:55:43 OffloadState : InHost
-
Format the output to a table with the properties you look for:
PS C:\> Get-NetTCPConnection -LocalPort 443 | Format-Table -Property LocalAddress, LocalPort, State, OwningProcess LocalAddress LocalPort State OwningProcess ------------ --------- ----- ------------- :: 443 Listen 4572 0.0.0.0 443 Listen 4572
-
If you want to find out a name of the process, run this command:
PS C:\> Get-Process -Id (Get-NetTCPConnection -LocalPort 443).OwningProcess Handles NPM(K) PM(K) WS(K) CPU(s) Id SI ProcessName ------- ------ ----- ----- ------ -- -- ----------- 143 15 3448 11024 4572 0 VisualSVNServer
answered Nov 2, 2016 at 19:19
bahrepbahrep
30k12 gold badges103 silver badges151 bronze badges
To get a list of all the owning process IDs associated with each connection:
netstat -ao |find /i "listening"
If want to kill any process have the ID and use this command, so that port becomes free
Taskkill /F /IM PID of a process
answered Apr 17, 2014 at 14:38
Monis MajeedMonis Majeed
1,35814 silver badges21 bronze badges
1
It is very simple to get the port number from a PID in Windows.
The following are the steps:
-
Go to run → type cmd → press Enter.
-
Write the following command…
netstat -aon | findstr [port number]
(Note: Don’t include square brackets.)
-
Press Enter…
-
Then cmd will give you the detail of the service running on that port along with the PID.
-
Open Task Manager and hit the service tab and match the PID with that of the cmd, and that’s it.
answered May 30, 2016 at 6:36
Nishat LakhaniNishat Lakhani
7331 gold badge8 silver badges20 bronze badges
0
netstat -aof | findstr :8080
(Change 8080 for any port)
answered Feb 16, 2021 at 23:59
David JesusDavid Jesus
1,9812 gold badges29 silver badges34 bronze badges
To find out which specific process (PID) is using which port:
netstat -anon | findstr 1234
Where 1234 is the PID of your process. [Go to Task Manager → Services/Processes tab to find out the PID of your application.]
answered Dec 14, 2018 at 6:55
Talha ImamTalha Imam
1,0461 gold badge20 silver badges22 bronze badges
2
In case someone need an equivalent for macOS like I did, here is it:
lsof -i tcp:8080
After you get the PID
of the process, you can kill it with:
kill -9 <PID>
answered Aug 12, 2020 at 11:22
wzsowzso
3,5325 gold badges28 silver badges48 bronze badges
2
Just open a command shell and type (saying your port is 123456):
netstat -a -n -o | find "123456"
You will see everything you need.
The headers are:
Proto Local Address Foreign Address State PID
TCP 0.0.0.0:37 0.0.0.0:0 LISTENING 1111
This is as mentioned here.
answered Jan 25, 2017 at 0:13
1
If you’d like to use a GUI tool to do this there’s Sysinternals’ TCPView.
answered Sep 7, 2008 at 6:40
David WebbDavid Webb
191k57 gold badges313 silver badges299 bronze badges
-
Open the command prompt — start → Run →
cmd
, or start menu → All Programs → Accessories → Command Prompt. -
Type
netstat -aon | findstr '[port_number]'
Replace the [port_number]
with the actual port number that you want to check and hit Enter.
- If the port is being used by any application, then that application’s detail will be shown. The number, which is shown at the last column of the list, is the PID (process ID) of that application. Make note of this.
-
Type
tasklist | findstr '[PID]'
Replace the [PID]
with the number from the above step and hit Enter.
- You’ll be shown the application name that is using your port number.
answered May 9, 2019 at 12:18
Anatole ABEAnatole ABE
5751 gold badge7 silver badges12 bronze badges
2
PowerShell
If you want to have a good overview, you can use this:
Get-NetTCPConnection -State Listen | Select-Object -Property *, `
@{'Name' = 'ProcessName';'Expression'={(Get-Process -Id $_.OwningProcess).Name}} `
| select ProcessName,LocalAddress,LocalPort
Then you get a table like this:
ProcessName LocalAddress LocalPort
----------- ------------ ---------
services :: 49755
jhi_service ::1 49673
svchost :: 135
services 0.0.0.0 49755
spoolsv 0.0.0.0 49672
For UDP, it is:
Get-NetUDPEndpoint | Select-Object -Property *, `
@{'Name' = 'ProcessName';'Expression'={(Get-Process -Id $_.OwningProcess).Name}} `
| select ProcessName,LocalAddress,LocalPort
answered Feb 27, 2022 at 22:16
Oliver GaidaOliver Gaida
1,7327 silver badges14 bronze badges
Netstat:
- -a displays all connection and listening ports
- -b displays executables
- -n stop resolve hostnames (numerical form)
-
-o owning process
netstat -bano | findstr "7002" netstat -ano > ano.txt
The Currports tool helps to search and filter
answered Sep 23, 2018 at 5:05
Blue CloudsBlue Clouds
7,3655 gold badges72 silver badges113 bronze badges
Type in the command: netstat -aon | findstr :DESIRED_PORT_NUMBER
For example, if I want to find port 80: netstat -aon | findstr :80
This answer was originally posted to this question.
answered Nov 22, 2016 at 15:36
TechnotronicTechnotronic
8,4744 gold badges40 silver badges53 bronze badges
netstat -ao
and netstat -ab
tell you the application, but if you’re not a system administrator you’ll get «The requested operation requires elevation».
It’s not ideal, but if you use Sysinternals’ Process Explorer you can go to specific processes’ properties and look at the TCP tab to see if they’re using the port you’re interested in. It is a bit of a needle and haystack thing, but maybe it’ll help someone…
answered Mar 13, 2014 at 19:57
Tony DelroyTony Delroy
103k15 gold badges177 silver badges253 bronze badges
1
Using Windows’ default shell (PowerShell) and without external applications
For those using PowerShell, try Get-NetworkStatistics
:
> Get-NetworkStatistics | where Localport -eq 8000
ComputerName : DESKTOP-JL59SC6
Protocol : TCP
LocalAddress : 0.0.0.0
LocalPort : 8000
RemoteAddress : 0.0.0.0
RemotePort : 0
State : LISTENING
ProcessName : node
PID : 11552
answered Aug 25, 2016 at 13:36
mikemaccanamikemaccana
112k99 gold badges392 silver badges497 bronze badges
3
I recommend CurrPorts from NirSoft.
CurrPorts can filter the displayed results. TCPView doesn’t have this feature.
Note: You can right click a process’s socket connection and select «Close Selected TCP Connections» (You can also do this in TCPView). This often fixes connectivity issues I have with Outlook and Lync after I switch VPNs. With CurrPorts, you can also close connections from the command line with the «/close» parameter.
answered Jun 29, 2015 at 22:07
JoshJosh
2,1422 gold badges23 silver badges20 bronze badges
0
A single-line solution that helps me is this one. Just substitute 3000 with your port:
$P = Get-Process -Id (Get-NetTCPConnection -LocalPort 3000).OwningProcess; Stop-Process $P.Id
Edit: Changed kill
to Stop-Process
for more PowerShell-like language
answered Feb 3, 2019 at 14:46
Angel VenchevAngel Venchev
7071 gold badge7 silver badges18 bronze badges
2
Use:
netstat -a -o
This shows the PID of the process running on a particular port.
Keep in mind the process ID and go to Task Manager and services or details tab and end the process which has the same PID.
Thus you can kill a process running on a particular port in Windows.
answered Aug 13, 2013 at 2:32
nishanisha
7112 gold badges14 silver badges28 bronze badges
To find pid who using port 8000
netstat -aon | findstr '8000'
To Kill that Process in windows
taskkill /pid pid /f
where pid is the process id which you get form first command
answered Jul 14, 2020 at 6:13
jizjiz
3083 silver badges7 bronze badges
2
Follow these tools: From cmd: C:\> netstat -anob
with Administrator privileges.
Process Explorer
Process Dump
Port Monitor
All from sysinternals.com.
If you just want to know process running and threads under each process, I recommend learning about wmic
. It is a wonderful command-line tool, which gives you much more than you can know.
Example:
c:\> wmic process list brief /every:5
The above command will show an all process list in brief every 5 seconds. To know more, you can just go with /?
command of windows , for example,
c:\> wmic /?
c:\> wmic process /?
c:\> wmic prcess list /?
And so on and so forth.
1
You can also check the reserved ports with the command below. Hyper-V reserve some ports, for instance.
netsh int ipv4 show excludedportrange protocol=tcp
answered Nov 24, 2020 at 14:50
При запуске новых сервисов в Windows, вы можете обнаружить что нужный порт уже занят (слушается) другой программой (процессом). Разберемся, как определить какая программ прослушивает определенный TCP или UDP порт в Windows.
Например, вы не можете запустить сайт IIS на стандартном 80 порту в Windows, т.к. этот порт сейчас занят (при запуске нескольких сайтов в IIS вы можете запускать их на одном или на разных портах). Как найти службу или процесс, который занял этот порт и завершить его?
Чтобы вывести полный список TCP и UDP портов, которые прослушиваются вашим компьютером, выполните команду:
netstat -aon| find "LIST"
Или вы можете сразу указать искомый номер порта:
netstat -aon | findstr ":80" | findstr "LISTENING"
Используемые параметры команды netstat:
- a – показывать сетевые подключения и открытые порты
- o – выводить идентфикатор професса (PID) для каждого подключения
- n – показывать адреса и номера портов в числовом форматер
По выводу данной команды вы можете определить, что 80 порт TCP прослушивается (статус
LISTENING
) процессом с PID 16124.
Вы можете определить исполняемый exe файл процесса с этим PID с помощью Task Manager или с помощью команды:
tasklist /FI "PID eq 16124"
Можно заменить все указанные выше команды одной:
for /f "tokens=5" %a in ('netstat -aon ^| findstr :80') do tasklist /FI "PID eq %a"
С помощью однострочной PowerShell команды можно сразу получить имя процесса, который прослушивает:
- TCP порт:
Get-Process -Id (Get-NetTCPConnection -LocalPort 80).OwningProcess
- UDP порт:
Get-Process -Id (Get-NetUDPEndpoint -LocalPort 53).OwningProcess
Можно сразу завершить этот процесс, отправив результаты через pipe в командлет Stop-Process:
Get-Process -Id (Get-NetTCPConnection -LocalPort 80).OwningProcess| Stop-Process
Проверьте, что порт 80 теперь свободен:
Test-NetConnection localhost -port 80
Чтобы быстрой найти путь к исполняемому файлу процесса в Windows, используйте команды:
cd /
dir tiny.exe /s /p
Или можно для поиска файла использовать встроенную команду where :
where /R C:\ tiny
В нашем случае мы нашли, что исполняемый файл
tiny.exe
(легкий HTTP сервер), который слушает 80 порт, находится в каталоге c:\Temp\tinyweb\tinyweb-1-94
Find Process ID of Process using given port in Windows
Once a while it happens that you try to start Tomcat and it complains “Port 8080 required by Tomcat v7.0 Server at localhost is already in use”. So that means there is already a process running in background that has occupied 8080 port. So how to identify the process in Windows task manager that is using port 8080? I am sure there must be a javaw.exe
. But is there a better way to identify which process in windows is using a given port number? Yes…
How to Find Process ID of process that uses a Port in Windows
Our friend netstat
will help us in identifying the process. netstat can list the running process and display information such as process id, port, etc. From this list we can filter the processes that has given port using findstr
command.
List process by port number
Code language: Bash (bash)
netstat -ano | findstr 8080
Output
Code language: Bash (bash)
Proto Local Address Foreign Address State PID TCP 0.0.0.0:8080 0.0.0.0:0 LISTENING 29848
-a
– Displays all connections and listening ports.-o
– Displays the owning process ID associated with each connection.-n
– Displays addresses and port numbers in numerical form.
We can use netstat
to list all the processes.
List all processes by PID
Code language: Bash (bash)
netstat -ano
Kill the Process by PID
Once we identify the process PID, we can kill the process with taskkill
command.
Code language: Bash (bash)
taskkill /F /PID 12345
Where /F
specifies to forcefully terminate the process(es). Note that you may need an extra permission (run from admin) to kill some certain processes.
Or else you can use our old trusted Windows Task Manager to kill the process for given process id. If PID is not visible in your task manager then you can enable it by Right clicking on table header under Details tab, click Select Columns and then check PID.
If you are using an application that needs to connect to the internet, like an online game, WhatsApp, etc., then it is definitely using and listening on a specific network port. Network ports are used by services and apps to send and receive data over the network.
Like an IP address guides traffic between different devices over the internet, a port defines which application or service the data is intended for, once it reaches (or leaves) a device.
There can be occasions when a network admin or even a simple user would need to know which port or ports are being used by a specific application or vice versa.
As a gamer, there are instances when you must use port forwarding on your router to reduce latency between the game and its servers. But that cannot be done without knowing which port it is using. This is where we come in.
In this guide, we will discuss how you can determine which port(s) are being used by an application on a Windows computer, or which app is using a specific port.
How to Check Which Port is Used by an App
First, we will show you how to check which port is being used by a specific application. For this, you must know the Process ID (PID) for the process running behind the application.
Follow these steps to check which port is being used by an application on a Windows computer:
-
First, we must find the PID for the process for the app for which you wish to find the listening port. For that, run the application, minimize it, and then open the Task Manager using the Ctrl + Shift + Esc shortcut keys.
-
In the Processes tab, expand the app processes by clicking on it, right-click on the app and then click Go to details from the context menu.
Open process details -
You will now be taken to the Details tab where the file name and its details for the associated process will be highlighted. Note down its PID which is in the second column from the left.
Note down the PID -
Now that you have the PID, run an elevated Command Prompt instance and use the following cmdlet to find its listening port. Replace [PID] with the Process ID noted in Step 3 above.
Note: You can also find the port number using the file name running the process. However, in that case, you would need to use the exact name of the file which is also case-sensitive. Therefore, we do not recommend that method since a single typo would make the result unobtainable.
netstat -aon | findstr [PID]
Find details using PID
In the last step above, you will have the details for the specific PID where you can see its local IP address followed by the port number being used (denoted after the colon), remote IP address and port number, connection state, and its PID (in that order – left to right).
From this, you shall have which port the application is using.
If it is using more than one port, then you will see multiple entry rows. However, if you enter an incorrect PID or the app is not using an internet connection, then you have no results after running the command above.
How to Check Which App is using a Specific Port
If you already know that your PC is listening on a specific port but want to know which app or service is using it, that can also be done. Here is how:
-
Run the following cmdlet in an elevated Command Prompt while replacing [PortNumber] with the port number that you already know is listening.
netstat -aon | findstr [PortNumber]
Find PID for the process running the app This will now give you different details about the app and its process, except for the name of the app. However, you will get the associated Process ID (PID), which is in the last column. Note down this PID.
-
Now, use the following cmdlet while replacing [PID] with the PID noted in the step above.
tasklist | findstr [PID]
Find app name using PID
As you can see in the image above, you will now have the name of the file running the process for that application, using which you now know which application is listening on that specific port.
If at any point in the process you did not get a result after running a cmdlet, then it is likely that you entered an incorrect port number or PID.
Moreover, an app can listen on multiple ports simultaneously, so do not be confused if you get multiple results.
Closing Thoughts
Port mapping can significantly improve your internet speed and reduce latency. But for that, you must know which port or ports you want to configure for maximum throughput. On a Windows PC, this is the way to go to find out which app is using which port, and vice versa.
Once you know which ports are being used by which apps, you can now configure them on your router. Or, you may close an open port by terminating its respective process/app.
Whenever an application wants to make itself accessible over the network, it claims a TCP/IP port, which means that port can’t be used by anything else. So if you need to use an in-use port, how do you tell what application is holding it?
There’s a number of ways to tell which application has the port locked, here we will use a windows built-in way using the command line and Task Manager.
Using Built-In Tools to See What is Listening on a Port
The first step is to use a command-line tool to see what ports are in use, and use a special flag that tells us which port is assigned to each Windows process identifier number. Then we can use that number to look up exactly which process it is.
Open up a command prompt and type in the following—you may have to open in Administrator mode to see all processes:
netstat -ab | more
This will immediately show you a list, although it’s maybe a little complicated. You’ll see the process name in the list, and you can search for it.
You can also use this other method, which takes an extra step, but makes it easier to locate the actual process:
netstat -aon | more
If you look on the right-hand side, you’ll see where I’ve highlighted the list of PIDs, or Process Identifiers. Find the one that’s bound to the port that you’re trying to troubleshoot—for this example, you’ll see that 0.0.0.0:80, or port 80, is in use by PID 1184.
Now you can simply open up Task Manager—you might have to use the option to Show Processes for All Users, and then you’ll be able to find the PID in the list. Once you’re there, you can use the End Process, Open File Location, or Go to Service(s) options to control the process or stop it.
Alternatively you can even use resource monitor to stop any process that is running. To open resource monitor type resmon.exe in run. This will bring up the resource monitor window.
There would be situations were some other process is running at port 80. To stop anything running in port 80 the following command can be used from command prompt.
net stop http /y
Frequently Asked Questions (FAQs)
What application is listening on a TCP IP port in Windows?
Netstat is a diagnostic tool that creates a list of open ports that the machine is listening to, as well as the ports it is currently connected to on other machines. In Netstat, stat stands for state or statistics, which tells you the current network status of every TCP connection.
How do I find out what application is using a TCP port?
You can use Netstat -b -a -o.
This tool provides a list of all open ports and their associated processes. The -o shows the process id, which you can look up in your task manager or processes tab. To end that process, simply enter taskkill /PID xxxx.
How can I tell if a server is listening on a port?
On the server itself, use Netstat -an to check to see which ports are listening. From outside the server, telnet host port can be used to check connections. A refused connection means nothing is running, whereas an accepted connection means something is running. Timeout implies a firewall is blocking access.
How do I find out what application is using port 8080?
Open the diagnostic tool, netstat -ano. This tool will list the PID (Process Identifier) that is listening to port 80. Open the Task Manager’s Processes tab. Select “View” and “Select Columns” menu. Activate the PID column to see the name of the process listening on port 80.
Is Port 8080 http or https?
Port 8080 is a non-standard, high number port that is popular as an alternative port for HTTP servers, most often application servers. Port 8443 is a default alternative port for HTTPS servers. It can also be used as an alternative port for any protocol like ssh, FTP, NTP, BOOTP, etc.
Why is port 8080 default?
Historically, only authorized system administrators were able to establish and operate a web server on port 80, since this was within the first 1023-port privileged region. When non-administrators wished to run their own web servers, they often chose port 8080 to host a secondary or alternate web server.