Get-NetTCPConnectionList TCP connections as objects

Purpose

Get-NetTCPConnection gives you the same information as netstat but as objects, so filtering and sorting are trivial and you can join to process data without parsing text.

List listeners

Get-NetTCPConnection -State Listen | Sort-Object LocalPort |
  Select-Object LocalAddress, LocalPort, OwningProcess

Find the process owning a port

Get-Process -Id (Get-NetTCPConnection -LocalPort 8080 -State Listen).OwningProcess

This is the PowerShell equivalent of the netstat -ano plus tasklist two-step, in one line. See port 8080 for what commonly listens there.

Filter by state or remote host

Get-NetTCPConnection -State Established |
  Group-Object OwningProcess |
  Sort-Object Count -Descending
Get-NetTCPConnection -RemoteAddress 93.184.215.14

Grouping by OwningProcess shows which program has the most open connections, useful when a process is exhausting ephemeral ports.

Add the process name to every row

Get-NetTCPConnection -State Listen | ForEach-Object {
  [pscustomobject]@{
    Port = $_.LocalPort
    PID  = $_.OwningProcess
    Name = (Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName
  }
} | Sort-Object Port

States

Same as netstat: Listen, Established, TimeWait, CloseWait, SynSent and others. Filter with -State.

Common mistakes

• Expecting UDP. Use Get-NetUDPEndpoint for UDP; see TCP vs UDP.
• Not handling exited processes. A connection in TIME_WAIT may have no live process; use -ErrorAction SilentlyContinue on Get-Process.
• Running elevated unnecessarily. Listing works without elevation; only some process details need it.