How can you find out which process is listening on

Question

How can you find out which process is listening on a port on Windows?

Answer 1

Follow these tools :- From cmd :- C:\> netstat -anob with Administrator privilege.

http://technet.microsoft.com/en-us/sysinternals/bb896653 - Process Explorer

http://technet.microsoft.com/en-us/sysinternals/bb896645 - Process Dump

http://technet.microsoft.com/en-us/sysinternals/bb896644 - Port Monitor

All from sysinternals.com

If you just want to know process running and threads under each process, I recommend to learn about wmic. Wonderful cmd line tool, which gives you much more than you can know.

Exampe :-

c:\> wmic process list brief /every:5

Above command will show all process list in brief every 5 seconds. To know more, you can just go with /? command of windows , for E.g,

c:\>wmic /?
c:\>wmic process /?
c:\>wmic prcess list /?

and so on and so forth. :)

Answer 2

Using Powershell...
...this would be your friend (replace 8080 with your port number):

 netstat -abno | Select-String -Context 0,1 -Pattern 8080

Sample output

>   TCP    0.0.0.0:8080           0.0.0.0:0              LISTENING         2920
   [tnslsnr.exe]
>   TCP    [::]:8080              [::]:0                 LISTENING         2920
   [tnslsnr.exe]

So in this example tnslsnr.exe (OracleXE database) is listening on port 8080.

Quick explanation
Select-String is used to filter the lengthy output of netstat for the relevant lines.
-Pattern tests each line against a regular expression.
-Context 0,1 will output 0 leading lines and 1 trailing line for each pattern match.

Answer 3

Use TCPView if you want a GUI for this. It's the old Sysinternals app that Microsoft bought out.

Answer 4

Programmatically, you need stuff from iphlpapi.h, for example GetTcpTable2(). Structures like MIB_TCP6ROW2 contain the owner PID.

Answer 5

With PowerShell 5 on Windows 10 or Windows Server 2016, run Get-NetTCPConnection cmdlet. I guess that it should also work on older Windows versions.

The default output of Get-NetTCPConnection does not include Process ID by some reason and it is a bit confusing. However, you could always get it by formatting the output. The property you are looking for is OwningProcess.

• If you want to find out the ID of the process that is listening on port 443, run this command:

  PS C:\> Get-NetTCPConnection -LocalPort 443 | Format-List
  
  LocalAddress   : ::
  LocalPort      : 443
  RemoteAddress  : ::
  RemotePort     : 0
  State          : Listen
  AppliedSetting :
  OwningProcess  : 4572
  CreationTime   : 02.11.2016 21:55:43
  OffloadState   : InHost
  

• Format the output to a table with the properties you look for:

  PS C:\> Get-NetTCPConnection -LocalPort 443 | Format-Table -Property LocalAddress, LocalPort, State, OwningProcess
  
  LocalAddress LocalPort  State OwningProcess
  ------------ ---------  ----- -------------
  ::                 443 Listen          4572
  0.0.0.0            443 Listen          4572
  

• If you want to find out a name of the process, run this command:

  PS C:\> Get-Process -Id (Get-NetTCPConnection -LocalPort 443).OwningProcess
  
  Handles  NPM(K)    PM(K)      WS(K)     CPU(s)     Id  SI ProcessName
  -------  ------    -----      -----     ------     --  -- -----------
  143      15     3448      11024              4572   0 VisualSVNServer
  

Answer 6

You can get more information if you run the following command:

netstat -aon |find /i "listening" |find "port"

using the 'Find' command allows you to filter the results. find /i "listening" will display only ports that are 'Listening'. Note, you need the /i to ignore Case otherwise you would type find "LISTENING". |find "port" will limit the results to only those containing the specific port number. Note, on this it will also filter in results that have the port number anywhere in the response string.