61

Using netstat -a -o -n I can get the list of ports and PID

then I need to go to task manager and add the PID and see who is it. (pretty frustrating)

enter image description here

I was wonder if there is a CMD command which does it all ( using find , for , powershell)

so that I could get the process name

2
  • netstat -b as admin, e.g. netstat -abon. And the name of the exe is below
    – barlop
    May 13, 2016 at 5:03
  • I dont see the PID when doing your command
    – Nathan B
    Dec 16, 2021 at 18:23

7 Answers 7

74

Solution

Use the -b parameter:

  -b            Displays the executable involved in creating each connection or
                listening port. In some cases well-known executables host
                multiple independent components, and in these cases the
                sequence of components involved in creating the connection
                or listening port is displayed. In this case the executable
                name is in [] at the bottom, on top is the component it called,
                and so forth until TCP/IP was reached. Note that this option
                can be time-consuming and will fail unless you have sufficient
                permissions.

Note The netstat -b command will fail unless run from an elevated command prompt.

Workaround

Filter the process list and find the PID you're interested in:

tasklist | findstr /c:"PID"  


Alternate solution

You can use Tcpvcon.exe instead. No admin rights required.

Tcpvcon usage is similar to that of the built-in Windows netstat utility.

Usage: tcpvcon [-a] [-c] [-n] [process name or PID]

 -a Show all endpoints (default is to show established TCP connections).
 -c Print output as CSV.
 -n Don't resolve addresses.
5
  • 1
    you're the man.
    – Royi Namir
    Jan 26, 2014 at 19:14
  • good answer, just commenting that I think it's amusing how the ms /? documentation even says "this option can be time-consuming" ! and it's purely a stupidity of windows that it is time consuming. Linux's netstat does its executable name showing fast. And also linux's executable name showing doesn't require root/admin privileges
    – barlop
    May 13, 2016 at 5:05
  • how to programatically get tcpvcon.exe, in C++. Does it come as a nuget package?
    – user754036
    Jun 18, 2020 at 5:13
  • I don't see the -b option in the manual: linux.die.net/man/8/netstat
    – Nathan B
    Dec 16, 2021 at 18:56
  • @NathanB You don't need it in Linux: netstat -vanp tcp | grep 3000 Aug 21, 2022 at 20:59
9

I think you are looking for TCPView from SysInternals.

6
  • I was wonder if there is a CMD command which does it all
    – Royi Namir
    Jan 26, 2014 at 16:13
  • Keep going - There is a command-line component of TCPView..
    – Leptonator
    Jan 26, 2014 at 16:14
  • oh ok. thought maybe someone already done it using for,find etc.
    – Royi Namir
    Jan 26, 2014 at 16:15
  • It should not be too hard to do.. I would bet robvanderwoude.com has something on it. Per the TCPView Page - "The TCPView download includes Tcpvcon, a command-line version with the same functionality."
    – Leptonator
    Jan 26, 2014 at 16:16
  • Very good tool suite.. if it wasn't for msys and sis I'd be using a nix box. :) Aug 7, 2015 at 18:38
4

Here is an example for windows using FOR to parse netstat output then DO tasklist with /fi filter on pid to show process name.

The last find is to remove tasklist headers.

FOR /F "usebackq tokens=5 delims= " %i IN (`netstat -ano ^|find "443"`) DO @tasklist /fi "pid eq %i" | find "%i"

prints records output like

tomcat8.exe.x64               4240 Services                   0    931,864 K

Additional fields from netstat can be added by adding tokens.

4
  • 1
    Pros of this solution including: 1. using find to filter out ports (in contrast, although netstat -b can provide process name directly, but going through its output to search manually is painful and error-prone); 2. using Windows native commands only, that is more flexible and independent.
    – Yingyu YOU
    Aug 9, 2016 at 5:31
  • 2
    Possible improvement: 1. to use findstr with /R option instead of find to utilize regex for better searching; 2. to use :443 *[[0-9]" as the pattern to filter out local port only. The whole command could be FOR /F "usebackq tokens=5 delims= " %i IN (`netstat -ano ^|findstr /R /C:":443 *[[0-9]"`) DO @tasklist /fi "pid eq %i" | findstr "%i"
    – Yingyu YOU
    Aug 9, 2016 at 5:55
  • @DavidPostill or @mark Could you clarify "Additional fields from netstat can be added by adding tokens."? Feb 2, 2017 at 10:06
  • 1
    @YvesSchelpe This might bring some light into the dark when it comes to FOR loops and tokens. Aug 21, 2022 at 21:32
3

If you're fond of using PS, you can fork this code (note: it's super-basic)

$nets = netstat -ano | select-string LISTENING
foreach($n in $nets){
    # make split easier PLUS make it a string instead of a match object:
    $p = $n -replace ' +',' '
    # make it an array:
    $nar = $p.Split(' ')
    # pick last item:
    $pname = $(Get-Process -id $nar[-1]).ProcessName
    $ppath = $(Get-Process -id $nar[-1]).Path
    # print the modified line with processname instead of PID:
    $n -replace "$($nar[-1])","$($ppath) $($pname)"
}

Note that you can try Path instead of ProcessName to get a full executable path - it won't work with system services though. Also, you may want to append the ProcessName to the end of the line instead of replacing the PID value.

Enjoy it ;)

2

Try to use this...

Process name with time stamp :) in oneliner... no need scripting fast and easy ...

You can change param SYN_SENT by ESTABLISHED or LISTENING

filter timestamp {"$(Get-Date -Format G): $_"};netstat -abno 1 | Select-String -Context 0,1 -Pattern LISTENING|timestamp

filter timestamp {"$(Get-Date -Format G): $_"};netstat -abno 1 | Select-String -Context 0,1 -Pattern SYN_SENT|timestamp
1
  • I used this with a pattern on the ip:port I wanted to observe. Great snippet!
    – Alex
    Aug 13, 2019 at 15:27
0

Very nice Erik Bitemo! I was thinking of adding a variable for the path then I realized you already have that although it was not defined. So the code I reused was:

$nets = netstat -ano |select-string LISTENING;
foreach ($n in $nets)
    {
# make split easier PLUS make it a string instead of a match object
    $p = $n -replace ' +',' ';
# make it an array
    $nar = $p.Split(' ')
# pick last item...
    $pname = $(Get-Process -id $nar[-1]).ProcessName
    $ppath = $(Get-Process -id $nar[-1]).Path;
# print the modified line with processname instead of PID
    $n -replace "$($nar[-1])","$($ppath) $($pname)" | where {$pname -like "*GMSVP*"}
     }

I was trying to find the processes and services for an application where I used a somewhat different 2 liner.

Get-Service | select status,name,displayname,servicename | where {($_.DisplayName -like "myserv*") -or ($_.servicename -like "post*")} | ft -auto

Get-Process | select id, processname,cpu,path,description | where {$_.path -like "*myserv*"} | ft -auto
1
  • I edited Erik's question to include your fix, so if you wish, you could delete it from your answer and concentrate on your approach with GetService and Get-Process.
    – flolilo
    Oct 7, 2017 at 13:17
0

you can use this software too https://www.smartnetmanager.com/download/snmhe-win64.exe

more details: https://www.smartnetmanager.com/blog/Advanced/how-to-supervise-the-activities-of-a-process

1
  • 1
    Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center.
    – Community Bot
    Nov 2, 2021 at 18:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .