COMMAND
netstatActive connections and listening ports
netstat shows the machine's active TCP and UDP connections and the ports it is listening on. The combination netstat -ano lists every connection with its state and the owning process ID, which is how you find out which program is using a given port. Add findstr to filter by port number.
Purpose
netstat (network statistics) reveals what a machine is doing on the network: which remote hosts it is connected to, which local ports are open and listening, and, with the right options, which process is responsible. It is the tool for answering "what is using port 8080?" and "is my server actually listening?".
Syntax
netstat [-a] [-n] [-o] [-b] [-p proto] [-r] [-s] [interval]Essential options
| Option | Effect |
|---|---|
-a | All connections and listening ports |
-n | Numeric; do not resolve names (faster, clearer) |
-o | Show the owning process ID (PID) |
-b | Show the executable (needs admin) |
-p tcp / -p udp | Filter by protocol |
-r | Routing table (same as route print) |
-s | Per-protocol statistics |
5 | Repeat every 5 seconds |
The command you will use most
netstat -ano | findstr :443 TCP 0.0.0.0:443 0.0.0.0:0 LISTENING 4
TCP 192.168.1.37:52344 93.184.215.14:443 ESTABLISHED 8210The last column is the PID. Identify it:
tasklist /fi "PID eq 8210"See tasklist and, to stop it, taskkill.
Connection states
| State | Meaning |
|---|---|
| LISTENING | A local program is waiting for connections on this port |
| ESTABLISHED | An active connection |
| TIME_WAIT | Recently closed; waiting for stray packets (see ephemeral ports) |
| CLOSE_WAIT | The remote end closed; the local app has not yet |
| SYN_SENT | A connection attempt is in progress |
Examples
Is my server listening where I expect?
netstat -ano | findstr LISTENINGA missing entry for your port explains a 502 Bad Gateway from a proxy in front of it.
Everything with executables (elevated):
netstat -anobProtocol statistics (retransmissions, errors):
netstat -s -p tcpCommon mistakes
- Forgetting
-n, so netstat tries reverse DNS on every address and hangs. - Reading the source port as the service.
192.168.1.37:52344is your ephemeral port; the service is the destination port. - Expecting
-bwithout elevation.
PowerShell equivalent
Get-NetTCPConnection -State Listen | Sort-Object LocalPort lists listeners as objects; join with Get-Process on OwningProcess to get names. See Get-NetTCPConnection.
Frequently asked questions
How do I find which process is using a port?
Run netstat -ano | findstr :PORT, read the PID in the last column, then tasklist /fi "PID eq PID" or open Task Manager's Details tab and match the PID.
What is the difference between -a and -an?
-a shows all connections and listening ports; -n prevents netstat from resolving addresses and ports to names, which is faster and clearer. -ano adds the owning process ID. Use -ano in almost every case.
Why does netstat -b say access denied?
Showing the executable name (-b) requires administrator rights. Run the command from an elevated prompt, or use -ano and look the PID up separately.