Sign up ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I try with netstat -ab -p tcp -n and among the results get:

  TCP              LISTENING
Can not obtain ownership information

I am running as administrator and get that message. I also downloaded a utility to show network activity for exe's but nothing open is listening on port 47001 according to the utility.

How can I find out what is listening?

share|improve this question
Did you try something like Wireshark? – vvsraju Feb 15 '11 at 19:04
@vvsraju wireshark is notorious for (understandably) not showing you the EXE. It's simply not mentioned in the packet. – barlop Jan 7 '13 at 22:17

3 Answers 3

up vote 8 down vote accepted

Try netstat -o to get the process id (PID) and then use tasklist |findstr <pid> to see the process name and type. Task Manager also shows PID and process name.

You can combine your other switches with -o like so: netstat -bona -p tcp

share|improve this answer
I hadn't mentioned -b because netstat with -b can be useful but some issues, A)it requires admin priv, and B)takes time to give a result. – barlop Oct 13 at 3:56
tasklist | find is an issue(hence also not mentioned pre cees edit), because bizarrely for some reason, it doesn't always work. What does always work with filtering tasklist is tasklist >a then type a |find (or as some prefer, find pattern file - one command). – barlop Oct 13 at 3:58
I sometimes use netstat -b with grep. netstat -abon | grep ":33" -A 1(the process name comes in square brackets one line after, sometimes two lines after so -A 2. One may forget and do grep -C 2 just for more info. Or to a file (netstat -abon >a) then grep, if I need to grep more than once(as the -b slows it down). As for useful switches, You can do netstat -aonp tcp or even netstat -paon tcp When you filter to find then there is less need for -p tcp. So netstat -aon | find ":1234" (for a port) or | find "1234" for a PID. – barlop Oct 13 at 3:59

Since your talking about windows, you can use "netstat -b" to see which executable is using that port.

Alternatively, Sysinternal's TCPVIew does the same, but in a much better way.

share|improve this answer
+1 for Sysinternals ... great tools! – tomjedrz Jul 13 at 23:35
He is using -b already; it's in -ab. Also, the contraction of "you are" is "you're". – Cees Timmerman Oct 12 at 18:44 lists this port as: winrm 47001/tcp Windows Remote Management Service Ryan Mack rmack& 29 April 2009

Now that doesn't prove that's what using it on your computer, but it's a pretty good guess.

share|improve this answer
I saw that as well, but I would like to be sure. If it is a windows service why can't netstat get the ownership info? – Jay White Feb 15 '11 at 19:22
@JayWhite I guess -b looks for a path, which the System service doesn't have. – Cees Timmerman Oct 12 at 18:47

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.