How-To Geek

How Can I Tell What is Listening on a TCP/IP Port in Windows?

Whenever an application wants to make itself accessible over the network, it claims a TCP/IP port, which means that port can’t be used by anything else. So if you need to use an in-use port, how do you tell what application is holding it?

There’s a number of ways to tell what application has the port locked, but we’ll walk through the built-in way using the command line and Task Manager, and then a great freeware application that does it all in one utility.

Use Built-In Tools to See What is Listening on a Port

The first step is to use a command-line tool to see what ports are in use, and use a special flag that tells us which port is assigned to each Windows process identifier number. Then we can use that number to look up exactly which process it is.

Open up a command prompt and type in the following—you may have to open in Administrator mode to see all processes:

netstat -ab | more

This will immediately show you a list, although it’s maybe a little complicated. You’ll see the process name in the list, and you can search for it.

You can also use this other method, which takes an extra step, but makes it easier to locate the actual process:

netstat -aon | more

If you look on the right-hand side, you’ll see where I’ve highlighted the list of PIDs, or Process Identifiers. Find the one that’s bound to the port that you’re trying to troubleshoot—for this example, you’ll see that, or port 80, is in use by PID 4708.


Now you can simply open up Task Manager—you might have to use the option to Show Processes for All Users, and then you’ll be able to find the PID in the list. Once you’re there, you can use the End Process, Open File Location, or Go to Service(s) options to control the process or stop it.


Use CurrPorts to View What is Listening

If you aren’t really the command-line type, or you’d rather just use a simple utility to do it all in one step, you can use the excellent freeware CurrPorts utility by NirSoft, one of our favorite freeware authors.

Just open up the utility, and you can see everything—processes, ports, remote ports, the full path to the process.


If you double-click on any of the items, you’ll see every single detail.


You can also use CurrPorts to directly kill the process if you want.

Download CurrPorts from

Lowell Heddings, better known online as the How-To Geek, spends all his free time bringing you fresh geekery on a daily basis. You can follow him on if you'd like.

  • Published 11/13/14
  • You can also run 'netstat -bona' and skip having to look at the task manager. The -b argument includes the process name in the output.

  • Andrey

    For powershell lovers wink : Get-NetworkStatistics | Format-Table

  • Jacob Zinicola

    True, but process name can be fairly useless when many tasks are handled by one process. A great example, which probably anyone will see on their system, is svchost.exe. Task Manager or other tools (e.g.: Process Explorer, services.msc, etc.) are needed to see what that process is actually doing.

    Also of note: To see the PID in Task Manager, you might have to enable that column. In Windows 7 or earlier, you do that from the View menu. In Windows 8, you right-click any column header.

  • Hi,

    Fascinating but scary, is it?

    How do you find out more about the ones which seem to be processes from microsoft? Also, I have a powerline set of extensions for the wifi, from Devolo, what are they doing listening? I assume they are wating for traffic on the particular Devolo unit?

More Articles You Might Like

Enter Your Email Here to Get Access for Free:

Go check your email!