Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

i tried running netstat -o to check what are the connections which are established. I saw two and they have PID numbers. When I checked it in my Task Manager, I couldn't find those PID numbers. Is there any way to find them?

share|improve this question
    
Have you selected the "show processes from all users" button/checkbox? Presumably you're running Windows - what version? – DMA57361 Sep 22 '10 at 8:01
    
Is it possible that the tasks have simply terminated between the netstat and the launch of Task Manager? – harrymc Sep 22 '10 at 8:24
    
@DMA5736: how can i show all processes from all users? i'm running windows 7 – tintincutes Sep 22 '10 at 10:11
    
Press the button indicated in this image, as found here (because I'm not on a Win7 machine at the moment to make my own screenshot). – DMA57361 Sep 22 '10 at 10:33
    
@DMA5736: i saw it and the other PID represent the spooler subsystem app. and the number 4 represents for the "System" not sure what they are doing in my PC as they represent established. I was suspecting that this might a keylogger or so... – tintincutes Sep 22 '10 at 10:56
up vote 6 down vote accepted

For example:

tasklist /FI "PID eq 736" /FO TABLE

Best tools to investigate Win processes I know about are from Sysinternals

Try using Process Explorer or TcpView

share|improve this answer
    
do i need to type this in the command prompt? – tintincutes Sep 22 '10 at 8:25
    
Yes, this is command line tool. Of course change the number of process id. – Casual Coder Sep 22 '10 at 8:36
    
i just would like to make sure if my understanding is correct. – tintincutes Sep 22 '10 at 10:10
    
does that mean i write it like this: "tasklist /FI "4 eq 736" /FO TABLE"... where did you get the 736? – tintincutes Sep 22 '10 at 10:11
    
Sorry, I've made typo. Filter should be "PID eq 736". 736 is example PID number. Ok, you obtain your pid that you would like to investigate further (with netstat -ao I've assumed). Then you type: tasklist /FI "PID eq YOUR_PID_NO_FROM_NETSTAT" and then other options (I added output formatting for instance). You can look up tasklist switches with tasklist /? – Casual Coder Sep 22 '10 at 10:21

To see PID numbers in task manager, first CTRL-SHIFT+ESC will bring up task manager (this is quicker than ctrl-alt-delete).

To show the PID of each process, click view->choose columns->pid and click ok

PID is the second item in the list of columns you can select.

share|improve this answer

You don't need Task Manager for tracking this. Just run netstat -b which will display the exe associated with the PID..

share|improve this answer
    
...but then how to stop that process? – Arjan Aug 5 '15 at 18:15

Some PID's you can see and some others you cannot. For example, I could not see PID=4 which is System. However I could see many others. Of course, I do not know the reason why. You can use the following command to see them. I have shown here a small portion of the output.


C:\Windows\system32>netstat -nao

Active Connections

  Proto  Local Address          Foreign Address        State           PID
  TCP    0.0.0.0:80             0.0.0.0:0              LISTENING       4
  TCP    0.0.0.0:135            0.0.0.0:0              LISTENING       840
  TCP    0.0.0.0:443            0.0.0.0:0              LISTENING       8112
  TCP    0.0.0.0:445            0.0.0.0:0              LISTENING       4
  TCP    0.0.0.0:554            0.0.0.0:0              LISTENING       7880
  TCP    0.0.0.0:1521           0.0.0.0:0              LISTENING       1080
  TCP    0.0.0.0:3389           0.0.0.0:0              LISTENING       1160
  TCP    0.0.0.0:3500           0.0.0.0:0              LISTENING       4
  TCP    0.0.0.0:5357           0.0.0.0:0              LISTENING       4
  TCP    0.0.0.0:6600           0.0.0.0:0              LISTENING       2216
  TCP    0.0.0.0:8080           0.0.0.0:0              LISTENING       1080
  TCP    0.0.0.0:8081           0.0.0.0:0              LISTENING       8112
  TCP    0.0.0.0:8090           0.0.0.0:0              LISTENING       4
  TCP    0.0.0.0:8093           0.0.0.0:0              LISTENING       3904
  TCP    0.0.0.0:18050          0.0.0.0:0              LISTENING       4
  TCP    0.0.0.0:30761          0.0.0.0:0              LISTENING       1968
  TCP    0.0.0.0:32843          0.0.0.0:0              LISTENING       4
  TCP    0.0.0.0:32844          0.0.0.0:0              LISTENING       4
  TCP    0.0.0.0:49152          0.0.0.0:0              LISTENING       544
  TCP    0.0.0.0:49153          0.0.0.0:0              LISTENING       1012
  TCP    0.0.0.0:49154          0.0.0.0:0              LISTENING       648
  TCP    0.0.0.0:49155          0.0.0.0:0              LISTENING       380
  TCP    0.0.0.0:49156          0.0.0.0:0              LISTENING       1484
  TCP    0.0.0.0:49202          0.0.0.0:0              LISTENING       700
share|improve this answer

go to http://live.sysinternals.com/ and download procexp.exe (process explorer) this will provide you with all the relevant details.

otheriwse you can find it in task manager by viewing the column for process ID

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .