2

I can only sort by bytes or port or protocol, not number of connections.

Imgur

3 Answers 3

4

Open a command prompt window as administrator.

From there type the following command:

netstat -b -a

This will give you a list of all open ports and their process associated with it.

If you need more information, type the following:

netstat -b -a -o

The -o will show the process id which you can look up in your taskmanager, processes tab, or if you need to kill that process, you can simply enter the following from the command prompt:

taskkill /PID xxxx

where xxxx is the process ID you found with netstat.

1
  • 1
    Using your suggestion, Chloe could add the -p tcp option to filter on TCP, so that he isn't seeing UDP output as well. I.e. netstat -b -a -p tcp. And, he could pipe the output into the find command and filter on lines that contain [, since the process name lines output by netstat include the process name within brackets. I.e., netstat -b -a -p tcp | find "[". And that output could be piped into sort, i.e, netstat -b -a -p tcp | find "[" | sort. Chloe might then more readily be able to see which process is occurring most often in the output from the netstat command.
    – moonpoint
    Jul 14, 2015 at 22:43
2

Microsoft provides a TCPView tool that will give you information on TCP connections by processes. You might be able to tell which process has the most connections with the Graphical User Interface (GUI) version of the tool, but to get the numbers for connections per process, I'd recommend using the command line utility, tcpvcon, that is included in the TCPView zip file you can download from the Microsoft TechNet site. Run the command from the command prompt with the -c option, which will create a Comma Separated Value (CSV) file.

c:\Program Files (x86)\TCPView>tcpvcon -c > %userprofile%\documents\tcpconnections.csv

The above command will store the output of tcpvcon in a file named tcpconnections.csv in the documents directory beneath the profile directory of the account from which you run the command, e.g., C:\Users\JDoe\Documents\tcpconnections.csv, if you ran it from an account with a userid of JDoe.

You can then count and sort the data using Microsoft Excel, the free OpenOffice Calc spreadsheet program, the free, online Google Sheets, or some other spreadsheet program.

The CSV file will contain the following columns:

A: TCP
B: Process Name
C: Process ID (PID)
D: State of connection, e.g. "WAIT", "ESTABLISHED", etc.
E: Address for local, source side of TCP connection
F: Address for remote side of the TCP connection

Steps you can use for Excel or other programs like Calc that can use the same formulas as Excel to count the number of occurrences of each process name in the list and then sort the list are as follows:

Put =COUNTIF($B$1:$B$196,"="&$B1) in column G1, which is the first row in the next empty column. Substitute the number of rows you actually have in the spreadsheet for 196. E.g., if you have 205 rows in the CSV file use that number rather than 196. The number that appears in that cell will be the number of occurrences of the process name in the list. Then copy that formula down through all the rows. Then sort on column G. See How to sort data by the most frequent value in Excel? if you need an explanation for the formula used.

2

Microsoft Network Monitor is a packet analyzer. It enables capturing, viewing, and analyzing network data and deciphering network protocols. It can be used to troubleshoot network problems and applications on the network.

enter image description here

Simple guide how start work with this program:

Press New capture. Press Start. Wait some minutes for fill the network log and then click on process for check how many was network connections.

Microsoft Network Monitor however old version and has been replaced by Microsoft Message Analyzer. But its not so user-friendly like this version and installed size increased from ~10mb to ~200mb.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .