Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I try with netstat -ab -p tcp -n and among the results get:

  TCP              LISTENING
Can not obtain ownership information

I am running as administrator and get that message. I also downloaded a utility to show network activity for exe's but nothing open is listening on port 47001 according to the utility.

How can I find out what is listening?

share|improve this question
Did you try something like Wireshark? – vvsraju Feb 15 '11 at 19:04
@vvsraju wireshark is notorious for (understandably) not showing you the EXE. It's simply not mentioned in the packet. – barlop Jan 7 '13 at 22:17
up vote 9 down vote accepted

Try netstat -o to get the process id (PID) and then use tasklist |findstr <pid> to see the process name and type. Task Manager also shows PID and process name.

You can combine your other switches with -o like so: netstat -bona -p tcp

share|improve this answer
I hadn't mentioned -b because netstat with -b can be useful but some issues, A)it requires admin priv, and B)takes time to give a result. – barlop Oct 13 '15 at 3:56
tasklist | find is an issue(hence also not mentioned pre cees edit), because bizarrely for some reason, it doesn't always work. What does always work with filtering tasklist is tasklist >a then type a |find (or as some prefer, find pattern file - one command). – barlop Oct 13 '15 at 3:58
I sometimes use netstat -b with grep. netstat -abon | grep ":33" -A 1(the process name comes in square brackets one line after, sometimes two lines after so -A 2. One may forget and do grep -C 2 just for more info. Or to a file (netstat -abon >a) then grep, if I need to grep more than once(as the -b slows it down). As for useful switches, You can do netstat -aonp tcp or even netstat -paon tcp When you filter to find then there is less need for -p tcp. So netstat -aon | find ":1234" (for a port) or | find "1234" for a PID. – barlop Oct 13 '15 at 3:59

Since your talking about windows, you can use "netstat -b" to see which executable is using that port.

Alternatively, Sysinternal's TCPVIew does the same, but in a much better way.

share|improve this answer
+1 for Sysinternals ... great tools! – tomjedrz Jul 13 '15 at 23:35
He is using -b already; it's in -ab. Also, the contraction of "you are" is "you're". – Cees Timmerman Oct 12 '15 at 18:44 lists this port as: winrm 47001/tcp Windows Remote Management Service Ryan Mack rmack& 29 April 2009

Now that doesn't prove that's what using it on your computer, but it's a pretty good guess.

share|improve this answer
I saw that as well, but I would like to be sure. If it is a windows service why can't netstat get the ownership info? – Jay White Feb 15 '11 at 19:22
@JayWhite I guess -b looks for a path, which the System service doesn't have. – Cees Timmerman Oct 12 '15 at 18:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .