How do I find out which process is listening on a TCP or UDP port on Windows?
34 Answers
PowerShell
TCP
Get-Process -Id (Get-NetTCPConnection -LocalPort YourPortNumberHere).OwningProcess
UDP
Get-Process -Id (Get-NetUDPEndpoint -LocalPort YourPortNumberHere).OwningProcess
cmd
netstat -a -b
(Add -n to stop it trying to resolve hostnames, which will make it a lot faster.)
Note Dane's recommendation for TCPView. It looks very useful!
-a Displays all connections and listening ports.
-b Displays the executable involved in creating each connection or listening port. In some cases well-known executables host multiple independent components, and in these cases the sequence of components involved in creating the connection or listening port is displayed. In this case the executable name is in [] at the bottom, on top is the component it called, and so forth until TCP/IP was reached. Note that this option can be time-consuming and will fail unless you have sufficient permissions.
-n Displays addresses and port numbers in numerical form.
-o Displays the owning process ID associated with each connection.
-
166and taskkill /PID <pid> to then terminate the process, using /F if appropriate. Mar 4, 2013 at 20:03
-
94You may have to run your command line shell as administrator, otherwise you may get an error message about insufficient privileges. Use the "Run as administrator" option when right-clicking cmd.exe.– GruberJul 29, 2014 at 11:20
-
9Works but requires elevated permission. Shift+right click on command icon -> run as administrator Jun 18, 2015 at 20:53
-
26Having got the PID - let's say it's
1234
- then you can usetasklist /fi "pid eq 1234"
to find out the name and other details of the process. Nov 28, 2017 at 10:32 -
7@RodionSychev The powershell command is expecting you to replace "portNumber" with the port number you are looking for. The error states that "portNumber" isn't a number.– MattOGSep 24, 2019 at 8:50
There's a native GUI for Windows:
Start menu → All Programs → Accessories → System Tools → Resource Monitor
or run
resmon.exe
,or from TaskManager → Performance tab.
-
63
-
9
-
3
-
8Can also be launched from Task Manager's Performance tab, at least in Windows 10. (Have not checked other versions.) Oct 9, 2016 at 13:55
-
12The comment of @user4836454 above is NOT correct: Resource Monitor DOES show ports with listeners, even if there is no network connection to these ports. Just look into the section "Listening Ports" instead of the section "TCP Connections".– JpsyDec 28, 2017 at 9:27
For Windows:
netstat -aon | find /i "listening"
-
47+1 But keep in mind, if your windows runs in a language other than english, you will have to change "listening" to the native term. E.g.
netstat -aon | find /i "abhören"
for german.– LeviteJun 30, 2014 at 10:29 -
6In my case it didn't work maybe because of quotes sign, but the solution netstat -aon | findstr LISTENING works perfectly! Nov 17, 2015 at 16:07
-
8I'm getting an error while trying to run this command on W10 15063.729 with PowerShell:
FIND: Parameter format not correct
Dec 22, 2017 at 18:05 -
1
-
1
Use TCPView if you want a GUI for this. It's the old Sysinternals application that Microsoft bought out.
-
10This is according to me the best option, especially since all processes are in the same list and you can close processes directly by right-clicking them. Jan 18, 2016 at 8:23
-
9
-
1
-
1
-
The -b switch mentioned in most answers requires you to have administrative privileges on the machine. You don't really need elevated rights to get the process name!
Find the pid of the process running in the port number (e.g., 8080)
netstat -ano | findStr "8080"
Find the process name by pid
tasklist /fi "pid eq 2216"
You can get more information if you run the following command:
netstat -aon | find /i "listening" |find "port"
using the 'Find' command allows you to filter the results. find /i "listening"
will display only ports that are 'Listening'. Note, you need the /i
to ignore case, otherwise you would type find "LISTENING". | find "port"
will limit the results to only those containing the specific port number. Note, on this it will also filter in results that have the port number anywhere in the response string.
-
10FWIW attempting to run this in PowerShell v2.0 yields error
FIND: Parameter format not correct
. You need to add a space after the find criteria. This will leave you withnetstat -aon | find /i "listening" | find "1234 "
.– self.Aug 25, 2015 at 13:16 -
3
-
1@self. I still get that error with PS 5.1, even after adding the space after the pipe. Do you know what's happening? Dec 22, 2017 at 18:11
-
3@NickeManarinin & @self either first change from powershell to cmd (just type cmd and press enter then redo the command) or in powershell use this command instead: netstat -aon |find /i "
{back tick}
"listening{back tick}
"" |find "{back tick}
"port{back tick}
"" (<- note the escaped quotes - excuse the termback tick
as i cannot add the actual character as it thinks its a snipping) Mar 5, 2018 at 6:37
Open a command prompt window (as Administrator) From "Start\Search box" Enter "cmd" then right-click on "cmd.exe" and select "Run as Administrator"
Enter the following text then hit Enter.
netstat -abno
-a Displays all connections and listening ports.
-b Displays the executable involved in creating each connection or listening port. In some cases well-known executables host multiple independent components, and in these cases the sequence of components involved in creating the connection or listening port is displayed. In this case the executable name is in [] at the bottom, on top is the component it called, and so forth until TCP/IP was reached. Note that this option can be time-consuming and will fail unless you have sufficient permissions.
-n Displays addresses and port numbers in numerical form.
-o Displays the owning process ID associated with each connection.
Find the Port that you are listening on under "Local Address"
Look at the process name directly under that.
NOTE: To find the process under Task Manager
Note the PID (process identifier) next to the port you are looking at.
Open Windows Task Manager.
Select the Processes tab.
Look for the PID you noted when you did the netstat in step 1.
If you don’t see a PID column, click on View / Select Columns. Select PID.
Make sure “Show processes from all users” is selected.
Get PID and Image Name
Use only one command:
for /f "tokens=5" %a in ('netstat -aon ^| findstr 9000') do tasklist /FI "PID eq %a"
where 9000
should be replaced by your port number.
The output will contain something like this:
Image Name PID Session Name Session# Mem Usage
========================= ======== ================ =========== ============
java.exe 5312 Services 0 130,768 K
Explanation:
it iterates through every line from the output of the following command:
netstat -aon | findstr 9000
from every line, the PID (
%a
- the name is not important here) is extracted (PID is the5
th element in that line) and passed to the following commandtasklist /FI "PID eq 5312"
If you want to skip the header and the return of the command prompt, you can use:
echo off & (for /f "tokens=5" %a in ('netstat -aon ^| findstr 9000') do tasklist /NH /FI "PID eq %a") & echo on
Output:
java.exe 5312 Services 0 130,768 K
-
2Good answer, but you should change it to
findstr :9000
if not,you would even find apps what contain the number (e.g. when you search "80" you would find apps on port 80, 800, 8000 too). Feb 4, 2019 at 14:16
First we find the process id of that particular task which we need to eliminate in order to get the port free:
Type
netstat -n -a -o
After executing this command in the Windows command line prompt (cmd), select the pid which I think the last column. Suppose this is 3312.
Now type
taskkill /F /PID 3312
You can now cross check by typing the netstat
command.
NOTE: sometimes Windows doesn’t allow you to run this command directly on CMD, so first you need to go with these steps:
From the start menu -> command prompt (right click on command prompt, and run as administrator)
With PowerShell 5 on Windows 10 or Windows Server 2016, run the Get-NetTCPConnection
cmdlet. I guess that it should also work on older Windows versions.
The default output of Get-NetTCPConnection
does not include Process ID for some reason and it is a bit confusing. However, you could always get it by formatting the output. The property you are looking for is OwningProcess
.
If you want to find out the ID of the process that is listening on port 443, run this command:
PS C:\> Get-NetTCPConnection -LocalPort 443 | Format-List LocalAddress : :: LocalPort : 443 RemoteAddress : :: RemotePort : 0 State : Listen AppliedSetting : OwningProcess : 4572 CreationTime : 02.11.2016 21:55:43 OffloadState : InHost
Format the output to a table with the properties you look for:
PS C:\> Get-NetTCPConnection -LocalPort 443 | Format-Table -Property LocalAddress, LocalPort, State, OwningProcess LocalAddress LocalPort State OwningProcess ------------ --------- ----- ------------- :: 443 Listen 4572 0.0.0.0 443 Listen 4572
If you want to find out a name of the process, run this command:
PS C:\> Get-Process -Id (Get-NetTCPConnection -LocalPort 443).OwningProcess Handles NPM(K) PM(K) WS(K) CPU(s) Id SI ProcessName ------- ------ ----- ----- ------ -- -- ----------- 143 15 3448 11024 4572 0 VisualSVNServer
To get a list of all the owning process IDs associated with each connection:
netstat -ao |find /i "listening"
If want to kill any process have the ID and use this command, so that port becomes free
Taskkill /F /IM PID of a process
-
1
It is very simple to get the port number from a PID in Windows.
The following are the steps:
Go to run → type cmd → press Enter.
Write the following command...
netstat -aon | findstr [port number]
(Note: Don't include square brackets.)
Press Enter...
Then cmd will give you the detail of the service running on that port along with the PID.
Open Task Manager and hit the service tab and match the PID with that of the cmd, and that's it.
To find out which specific process (PID) is using which port:
netstat -anon | findstr 1234
Where 1234 is the PID of your process. [Go to Task Manager → Services/Processes tab to find out the PID of your application.]
-
2It should be noted that you don't need the
-n
flag set twice.-ano
is enough. Mar 29, 2019 at 18:56 -
sometimes ports are in use and we need to run these commands: net stop hns net start hns Mar 10, 2022 at 8:09
In case someone need an equivalent for macOS like I did, here is it:
lsof -i tcp:8080
After you get the PID
of the process, you can kill it with:
kill -9 <PID>
-
Yes, but it is tagged with "Windows". The title is "How do I find out which process is listening on a TCP or UDP port on Windows?" Sep 29, 2022 at 19:32
-
Related: Find which process is listening on port 8001 on Mac OS X Sep 29, 2022 at 19:55
Just open a command shell and type (saying your port is 123456):
netstat -a -n -o | find "123456"
You will see everything you need.
The headers are:
Proto Local Address Foreign Address State PID
TCP 0.0.0.0:37 0.0.0.0:0 LISTENING 1111
This is as mentioned here.
-
1FYI/for anyone interested: It's either
findstr 123456
(without quotes) orfind "123456"
(with quotes). (@Josh) Jun 13, 2018 at 15:05
Open the command prompt - start → Run →
cmd
, or start menu → All Programs → Accessories → Command Prompt.Type
netstat -aon | findstr '[port_number]'
Replace the [port_number]
with the actual port number that you want to check and hit Enter.
- If the port is being used by any application, then that application’s detail will be shown. The number, which is shown at the last column of the list, is the PID (process ID) of that application. Make note of this.
Type
tasklist | findstr '[PID]'
Replace the [PID]
with the number from the above step and hit Enter.
- You’ll be shown the application name that is using your port number.
-
3On Win 10: Your command in step 2 and step 4 does not work unless you replace simple quotes by double quotes. Should say netstat -aon | findstr "[port_number]" Jun 6, 2019 at 18:34
-
Netstat:
- -a displays all connection and listening ports
- -b displays executables
- -n stop resolve hostnames (numerical form)
-o owning process
netstat -bano | findstr "7002" netstat -ano > ano.txt
The Currports tool helps to search and filter
Type in the command: netstat -aon | findstr :DESIRED_PORT_NUMBER
For example, if I want to find port 80: netstat -aon | findstr :80
This answer was originally posted to this question.
netstat -ao
and netstat -ab
tell you the application, but if you're not a system administrator you'll get "The requested operation requires elevation".
It's not ideal, but if you use Sysinternals' Process Explorer you can go to specific processes' properties and look at the TCP tab to see if they're using the port you're interested in. It is a bit of a needle and haystack thing, but maybe it'll help someone...
-
If you're not an admin you won't be able to use Process Explorer (or even Windows Task Manager > Resource Manager) to get this info from any process that is not yours to begin with.– AbelJan 25, 2017 at 11:52
Using Windows' default shell (PowerShell) and without external applications
For those using PowerShell, try Get-NetworkStatistics
:
> Get-NetworkStatistics | where Localport -eq 8000
ComputerName : DESKTOP-JL59SC6
Protocol : TCP
LocalAddress : 0.0.0.0
LocalPort : 8000
RemoteAddress : 0.0.0.0
RemotePort : 0
State : LISTENING
ProcessName : node
PID : 11552
-
I don't think it Get-NetworkStatistics is installed as default. It returns me the following: The term 'Get-NetworkStatistics' is not recognized as the name of a cmdlet Feb 22, 2022 at 14:55
-
-
PowerShell
If you want to have a good overview, you can use this:
Get-NetTCPConnection -State Listen | Select-Object -Property *, `
@{'Name' = 'ProcessName';'Expression'={(Get-Process -Id $_.OwningProcess).Name}} `
| select ProcessName,LocalAddress,LocalPort
Then you get a table like this:
ProcessName LocalAddress LocalPort
----------- ------------ ---------
services :: 49755
jhi_service ::1 49673
svchost :: 135
services 0.0.0.0 49755
spoolsv 0.0.0.0 49672
For UDP, it is:
Get-NetUDPEndpoint | Select-Object -Property *, `
@{'Name' = 'ProcessName';'Expression'={(Get-Process -Id $_.OwningProcess).Name}} `
| select ProcessName,LocalAddress,LocalPort
I recommend CurrPorts from NirSoft.
CurrPorts can filter the displayed results. TCPView doesn't have this feature.
Note: You can right click a process's socket connection and select "Close Selected TCP Connections" (You can also do this in TCPView). This often fixes connectivity issues I have with Outlook and Lync after I switch VPNs. With CurrPorts, you can also close connections from the command line with the "/close" parameter.
A single-line solution that helps me is this one. Just substitute 3000 with your port:
$P = Get-Process -Id (Get-NetTCPConnection -LocalPort 3000).OwningProcess; Stop-Process $P.Id
Edit: Changed kill
to Stop-Process
for more PowerShell-like language
-
6You probably don't want to kill the process automatically. I would separate that kill command and explain it. Don't want some poor user copy-pasting that without thinking carefully. Feb 19, 2019 at 20:27
-
1And if you're going for the full PowerShell solution change kill to Stop-Process
Get-Process -Id (Get-NetTCPConnection -LocalPort 3000).OwningProcess | Stop-Process
– CubanXDec 13, 2019 at 16:02
To find pid who using port 8000
netstat -aon | findstr '8000'
To Kill that Process in windows
taskkill /pid pid /f
where pid is the process id which you get form first command
-
1
-
PID is the value returned by the first command in the last column. Jan 23, 2021 at 9:38
Follow these tools: From cmd: C:\> netstat -anob
with Administrator privileges.
All from sysinternals.com.
If you just want to know process running and threads under each process, I recommend learning about wmic
. It is a wonderful command-line tool, which gives you much more than you can know.
Example:
c:\> wmic process list brief /every:5
The above command will show an all process list in brief every 5 seconds. To know more, you can just go with /?
command of windows , for example,
c:\> wmic /?
c:\> wmic process /?
c:\> wmic prcess list /?
And so on and so forth. :)
-
PortMon (the link behind Port Monitor) is for monitoring serial and parallel ports, not network ports.– JamesJun 2, 2020 at 23:35
Use:
netstat -a -o
This shows the PID of the process running on a particular port.
Keep in mind the process ID and go to Task Manager and services or details tab and end the process which has the same PID.
Thus you can kill a process running on a particular port in Windows.
You can also check the reserved ports with the command below. Hyper-V reserve some ports, for instance.
netsh int ipv4 show excludedportrange protocol=tcp
Programmatically, you need stuff from iphlpapi.h, for example GetTcpTable2(). Structures like MIB_TCP6ROW2 contain the owner PID.
netstat -aof | findstr :8080
(Change 8080 for any port)