FileCloud Blog

How to find what application is listening on a TCP/IP port in windows using netstat?

Whenever an application wants to make itself accessible over the network, it claims a TCP/IP port, which means that port can’t be used by anything else. So if you need to use an in-use port, how do you tell what application is holding it?

There’s a number of ways to tell which application has the port locked, here we will use a windows built-in way using the command line and Task Manager.

Using Built-In Tools to See What is Listening on a Port

The first step is to use a command-line tool to see what ports are in use, and use a special flag that tells us which port is assigned to each Windows process identifier number. Then we can use that number to look up exactly which process it is.

Open up a command prompt and type in the following—you may have to open in Administrator mode to see all processes:

netstat -ab | more

This will immediately show you a list, although it’s maybe a little complicated. You’ll see the process name in the list, and you can search for it.

You can also use this other method, which takes an extra step, but makes it easier to locate the actual process:

netstat -aon | more

If you look on the right-hand side, you’ll see where I’ve highlighted the list of PIDs, or Process Identifiers. Find the one that’s bound to the port that you’re trying to troubleshoot—for this example, you’ll see that 0.0.0.0:80, or port 80, is in use by PID 1184.

Now you can simply open up Task Manager—you might have to use the option to Show Processes for All Users, and then you’ll be able to find the PID in the list. Once you’re there, you can use the End Process, Open File Location, or Go to Service(s) options to control the process or stop it.

Alternatively you can even use resource monitor to stop any process that is running. To open resource monitor type resmon.exe in run. This will bring up the resource monitor window.

There would be situations were some other process is running at port 80. To stop anything running in port 80 the following command can be used from command prompt.

How to Check for Ports in Use in Windows 10

At any one time, there’s a whole bunch of information being sent between your Windows 10 PC and the endless void of the Internet. This is done using a process whereby network-dependent processes seek out TCP and UDP ports, which they use to communicate with the Internet. First, your data gets sent to remote ports at the destination or website your processes are trying to connect to, then it gets received at local ports back on your PC.

Most of the time, Windows 10 knows how to manage ports and ensure that traffic is being directed through the right ports so that those processes can connect with what they need to. But sometimes two processes may be assigned to one port, or maybe you just want to get a better picture of your network traffic and what’s going in and out.

That’s why wrote this guide that shows you how to get an overview of your ports and see which applications are using which ports.

Use Nirsoft CurrPorts

NirSoft is one of the best indie software developers, giving us great utilities, like PassView and WirelessKeyView. While some people will prefer checking their ports without installing third-party software (in which case, scroll down to the CMD method), CurrPorts is easily the fastest and most convenient way to view your ports.

Once you’ve installed CurrPorts, just open it to see a list of all your ports currently in use. If you’re looking for local ports in use, just click the “Local Port” column at the top to order the list by port number (handy if you’re looking for a specific one). You can do the same thing with remote ports, too.

If you want to really find specific ports, click the “Advanced Filters” icon at the top and enter your string in the format they suggest. It should look something like the below image.

Hit OK when you’re ready, and the list will filter down to your queries.

Command Prompt Method

The integrated – though not necessarily the simplest – way to check open ports is to use the trusty command prompt.

Click the Start button, type cmd , then right-click “Command Prompt” when it shows up in the search results. Click “Run as administrator.”

Once you’re in the elevated command prompt, enter the following command:

This will steadily bring up a list of ports that is probably quite long, along with the Windows processes that are using them. (You can press Ctrl + A , then Ctrl + C to copy all information to the clipboard.) On the average PC, there will be two main local IP addresses that contain ports on your PC.

The first, in our case, is “127.0.0.1.” This IP address is otherwise known as “localhost” or a “loopback address,” and any process listening to ports here is communicating internally on your local network without using any network interface. The actual port is the number you see after the colon. (See image below.)

The bulk of your processes will probably be listening to ports prefixed with “192.168.xxx.xxx,” which is your IP address. This means the processes you see listed here are listening for communications from remote Internet locations (such as websites). Again, the port number is the number after the colon.

TCPView

If you don’t mind installing a third-party app and want to have more control over what’s going on with all your ports, you can use a lightweight app called TCPView. This immediately brings up a list of processes and their associated ports.

What make this better than the command prompt is that you can actively see the ports opening, closing and sending packets. Just look for the green, red and yellow highlights. You can also reorder the list by clicking the column headings, making it easier to find the process you want or two separate processes vying for the same port.

If you do find a process or connection you want to close, just right-click that process. You can then select “End process,” which is exactly the same function as the one in Windows task manager. Or you can click “Close Connection” to leave the process open but stop it from listening on a given port.

If you’re having some trouble in Windows 10, then see whether a Windows update may be causing it. We also have a handy guide for managing the health of your hard drive in Windows 10.

Related:

Content Manager at Make Tech Easier. Enjoys Android, Windows, and tinkering with retro console emulation to breaking point.

Find the PID of a process that uses a port on Windows

My service crash on startup with the classic:

How can I find the process for killing it?

7 Answers 7

Just open a command shell and type (saying your port is 123456):

You will see everything you need.

The headers are:

Find the PID of a process that uses a port on Windows (e.g. port: «9999»)

-a Displays all connections and listening ports.

-o Displays the owning process ID associated with each connection.

-n Displays addresses and port numbers in numerical form.

Then kill the process by PID

/F — Specifies to forcefully terminate the process(es).

Note: You may need an extra permission (run from administrator) to kill some certain processes

Command:

Output:

Now cut the process ID, «10396», using the for command in Windows.

Command:

Output:

If you want to cut the 4th number of the value means «LISTENING» then command in Windows.

Command:

Output:

If you want to do this programmatically you can use some of the options given to you as follows in a PowerShell script:

However; be aware that the more accurate you can be the more precise your PID result will be. If you know which host the port is supposed to be on you can narrow it down a lot. netstat -aon | findstr «0.0.0.0:9999» will only return one application and most llikely the correct one. Only searching on the port number may cause you to return processes that only happens to have 9999 in it, like this:

The most likely candidate usually ends up first, but if the process has ended before you run your script you may end up with PID 12331 instead and killing the wrong process.

What is My Port Number?

Since certain games and programs use different ports to function, knowing your port numbers can be useful when it comes to configuring firewalls or give certain apps access. Learn the steps to find your port number on any OS.

Jump to…

How to Find Your Port Number

Here’s how to find your port number on Windows 8, Windows 10, or Mac device:

How to find ports being used in Windows

1. Open Command Prompt by typing cmd in the search box.
2. Enter ipconfig at the prompt This provides you with some outputs about your IP address. Note that if you are behind a router, you may not see your public IP. You may instead see a router IP, such as 192.168.1.1 or 192.168.2.31. If you want your public IP, you can go to What is my IP.
3. Now, type netstat -a for a list of connections and port numbers that are currently being used. Note that the output of this will take a good ten minutes or so.

How to find the port number on macOS

1. Open System Preferences by clicking on the Apple icon.
2. Go to Network .
3. Choose your network and then click Advanced .
4. Select the Port Scan tab.
5. Enter the IP address you want to scan. If you need to know your IP address, go to What is my IP.

Get started with the most trusted VPN service at $0.99. Try now

What is a Port Number?

To put it simply, a port number is the means through which a specific message is identified when it’s forwarded to a server. As there are 65,535 ports for each IP address, a specific designation would refer to one or several of those thousands of ports. Depending upon the service type, the message will either be associated with a TCP or a UDP port.

TCP vs. UDP

TCP stands for Transmission Control Protocol and sends the data after establishing a connection. which makes it more reliable than UDP for data transfers. On the other hand, UDP stands for User Datagram Protocol and sends data packets connection-less which makes it lightweight and significantly faster than TCP. You don’t really need to be particularly concerned with the details of TCP versus UDP here; port forwarding might apply to TCP or UDP, though..

What is the Difference between an IP Address and a Port Number?

A computer network is made up of a collection of devices – such as routers, printers, laptops, and cameras – that are connected together for sharing data and resources.

Each device within the network has a unique numerical label allocated to it, known as the Internet Protocol (IP) address. This helps with two main functions:

• Network or host identification
• Location addressing

A port number works in tandem with the IP address to direct specific traffic to a specific destination on a network. This can be done to optimize performance or to grant access altogether, as in the case of a web server. If the webserver port wasn’t open, you wouldn’t be able to run one, and people wouldn’t be able to connect to you.

The following are answers to some of the most frequently asked questions about port numbers.

Why Do I Need to Know my Port Number?

You need to use different ports for specific applications and that’s why you should know about port numbers. With the help of port numbers, you can:

• Configure security firewalls on any device, be it Windows or Mac
• Filter out IP addresses that range from mail service (SMTP), file transfer (FTP), web service (HTTP)
• Learn which incoming port is receiving or sending encrypted data and which one aren’t
• Enhance your online security without compromising private data

What is an IP Address?

An IP address is simply an address on the internet. Just like homes have addresses, so do computers connected to the internet.
There are two types of IP addresses: public and private. The private IP is the address allocated to your device by your router. The public IP address is provided by your ISP and it is the address that allows you to explore the internet. You can easily check your IP address via an IP lookup tool. Visit the IP lookup tool, and it will show your public IP address as well as IP location, ISP and even operating system.

How do I find the port number of a specific IP address?

All you have to do is type “netstat -a” on Command Prompt and hit the Enter button. This will populate a list of your active TCP connections. The port numbers will be shown after the IP address and the two are separated by a colon. For instance, if your IP address is something like 192.168.45.2 and you’re being displayed an entry for 192.168.45.2:57961, it means the port number 57961 is open and possibly in use.

What does a port scanner do?

Basically, a port scanner probes a host or server for open ports. These applications are commonly used by administrators to verify network security policies (but usually to see that ports are CLOSED, not open). In fact, even hackers use port scanners to identify open ports on a host so they can exploit any vulnerabilities attributed to those open ports.

Is my port open?

There are many port checking tools available on the internet that allow you to check your public (external) IP address and detect if there are any open ports associated with your IP address. This can help you in checking if port forwarding has been set up correctly on your router, or if a firewall is getting in the way of your server applications.