Whenever an application wants to make itself accessible over the network, it claims a TCP/IP port, which means that port can’t be used by anything else. So if you need to use an in-use port, how do you tell what application is holding it? There’s a number of ways to tell which application has the port locked, here we will use a windows built-in way using the command line and Task Manager. Using Built-In Tools to See What is Listening on a Port The first step is to use a command-line tool to see what ports are in use, and use a special flag that tells us which port is assigned to each Windows process identifier number. Then we can use that number to look up exactly which process it is. Open up a command prompt and type in the following—you may have to open in Administrator mode to see all processes: netstat -ab | more This will immediately show you a list, although it’s maybe a little complicated. You’ll see the process name in the list, and you can search for it. You can also use this other method, which takes an extra step, but makes it easier to locate the actual process:
If you look on the right-hand side, you’ll see where I’ve highlighted the list of PIDs, or Process Identifiers. Find the one that’s bound to the port that you’re trying to troubleshoot—for this example, you’ll see that 0.0.0.0:80, or port 80, is in use by PID 1184. Now you can simply open up Task Manager—you might have to use the option to Show Processes for All Users, and then you’ll be able to find the PID in the list. Once you’re there, you can use the End Process, Open File Location, or Go to Service(s) options to control the process or stop it. Alternatively you can even use resource monitor to stop any process that is running. To open resource monitor type resmon.exe in run. This will bring up the resource monitor window. There would be situations were some other process is running at port 80. To stop anything running in port 80 the following command can be used from command prompt. net stop http /y Frequently Asked Questions (FAQs) What application is listening on a TCP IP port in Windows? How do I find out what application is using a TCP port? This tool provides a list of all open ports and their associated processes. The -o shows the process id, which you can look up in your task manager or processes tab. To end that process, simply enter taskkill /PID xxxx. How can I tell if a server is listening on a port? How do I find out what application is using port 8080? Is Port 8080 http or https? Why is port 8080 default? After configuring network services, it is important to pay attention to which ports are actually listening on the system's network interfaces. Any open ports can be evidence of an intrusion. There are two basic approaches for listing the ports that are listening on the network. The less reliable approach is to query the network stack by typing commands such as netstat -an or lsof -i. This method is less reliable since these programs do not connect to the machine from the network, but rather check to see what is running on the system. For this reason, these applications are frequent targets for replacement by attackers. In this way, crackers attempt to cover their tracks if they open unauthorized network ports. A more reliable way to check which ports are listening on the network is to use a port scanner such as nmap. The following command issued from the console determines which ports are listening for TCP connections from the network: The output of this command looks like the following:
This output shows the system is running portmap due to the presence of the sunrpc service. However, there is also a mystery service on port 834. To check if the port is associated with the official list of known services, type:
This command returns no output. This indicates that while the port is in the reserved range (meaning 0 through 1023) and requires root access to open, it is not associated with a known service. Next, check for information about the port using netstat or lsof. To check for port 834 using netstat, use the following command: The command returns the following output:
The presence of the open port in netstat is reassuring because a cracker opening a port surreptitiously on a hacked system would likely not allow it to be revealed through this command. Also, the [p] option reveals the process id (PID) of the service which opened the port. In this case, the open port belongs to ypbind (NIS), which is an RPC service handled in conjunction with the portmap service. The lsof command reveals similar information since it is also capable of linking open ports to services: Below is the relevant portion of the output for this command:
These tools reveal a great deal about the status of the services running on a machine. These tools are flexible and can provide a wealth of information about network services and configuration. Consulting the man pages for lsof, netstat, nmap, and services is therefore highly recommended.
Connections between applications work much like conversations between humans. The conversation is started by someone speaking. If no one is listening, then the conversation doesn’t get far. How do you know who’s listening on a Windows PC? The Netstat command-line utility and the PowerShell Get-NetTCPConnection cmdlet. Not a reader? Watch this related video tutorial! Not seeing the video? Make sure your ad blocker is disabled.In this tutorial, you will learn how to inspect listening ports and established TCP connections on your Windows computer with Netstat and the native PowerShell command Get-NetTCPConnection.
PrerequisitesIf you’d like to follow along with examples in this tutorial, be sure you have:
Using Netstat to Find Active and Listening PortsNetstat is one of those command-line utilities that seems like it’s been around forever. It’s been a reliable command-line utility to inspect local network connections for a long time. Let’s check out how to use it to find listening and established network connections.
Assuming you’re on a Windows PC: 1. Open up an elevated command prompt (cmd.exe). 2. Run netstat -a to find all of the listening and established connections on the PC. By default, netstat only returns listening ports. Using the -a parameter tells netstat to return listening and established connections.
The output above is broken out into four columns:
3. Now run netstat -an. You should now see that any names in the output have been turned into IP addresses. By default, netstat attempts to resolve many IP addresses to names.
4. Finally, perhaps you’d like to know the Windows processes that are listening or have these connections open. To find that, use the -b switch.
Now that you’ve got a chance to see how the old-school netstat utility shows active and listening ports, let’s see how to do it in PowerShell. Using PowerShell gives you a lot more control to see just what you want, rather than having to scroll through long lists of output. The Get-NetTCPConnection cmdlet is much more specific than netstat about what you want to see.
On your Windows PC: 1. Open up a PowerShell console as administrator.
2. Run Get-NetTcpConnection. You’ll see output similar to what netstat provided. Instead of just a big string of output, Get-NetTcpConnection returns a list of PowerShell objects. You can now see the same general information that netstat provided you by now; by default, you have information on the OwningProcess (the -b switch on netstat) and the AppliedSetting field, which relates to the network profile the connection is a part of.
3. Pipe the output to Select-Object showing all properties. You’ll see PowerShell returns a lot more information that netstat did. Get-NetTCPConnection | Select-Object -Property *
4. Now, narrow down the output to just listening ports. Get-NetTCPConnection -State Listen
5. Now, find the process names for the OwningProcess fields. To do that, run the Get-Process cmdlet and provide the process ID as shown below.
If you’d like to create another property for the process name, you could optionally use a Select-Object calculated field. Get-NetTCPConnection | Select-Object -Property *,@{'Name' = 'ProcessName';'Expression'={(Get-Process -Id $_.OwningProcess).Name}} 6. Narrow down the states to a bit more by finding Listening and Established states by defining the State parameter value as a comma-delimited list. Get-NetTCPConnection -State Listen,Established 7. Finally, limit the connections down by the port the connection is connected to with the RemotePort parameter.
Get-NetTCPConnection -RemotePort 443
You have now seen how the Netstat utility and the Get-NetTCPConnection PowerShell cmdlet help you find local network connections. Now that you can show the processes running on a server combine this with the Test-NetConnection PowerShell cmdlet to get an end-to-end view of connectivity between a client and server. |