23

i tried running netstat -o to check what are the connections which are established. I saw two and they have PID numbers. When I checked it in my Task Manager, I couldn't find those PID numbers. Is there any way to find them?

7
  • Have you selected the "show processes from all users" button/checkbox? Presumably you're running Windows - what version? – DMA57361 Sep 22 '10 at 8:01
  • Is it possible that the tasks have simply terminated between the netstat and the launch of Task Manager? – harrymc Sep 22 '10 at 8:24
  • @DMA5736: how can i show all processes from all users? i'm running windows 7 – tintincutes Sep 22 '10 at 10:11
  • Press the button indicated in this image, as found here (because I'm not on a Win7 machine at the moment to make my own screenshot). – DMA57361 Sep 22 '10 at 10:33
  • @DMA5736: i saw it and the other PID represent the spooler subsystem app. and the number 4 represents for the "System" not sure what they are doing in my PC as they represent established. I was suspecting that this might a keylogger or so... – tintincutes Sep 22 '10 at 10:56
16

For example:

tasklist /FI "PID eq 736" /FO TABLE

Best tools to investigate Win processes I know about are from Sysinternals

Try using Process Explorer or TcpView

12
  • do i need to type this in the command prompt? – tintincutes Sep 22 '10 at 8:25
  • 1
    Yes, this is command line tool. Of course change the number of process id. – Casual Coder Sep 22 '10 at 8:36
  • i just would like to make sure if my understanding is correct. – tintincutes Sep 22 '10 at 10:10
  • does that mean i write it like this: "tasklist /FI "4 eq 736" /FO TABLE"... where did you get the 736? – tintincutes Sep 22 '10 at 10:11
  • Sorry, I've made typo. Filter should be "PID eq 736". 736 is example PID number. Ok, you obtain your pid that you would like to investigate further (with netstat -ao I've assumed). Then you type: tasklist /FI "PID eq YOUR_PID_NO_FROM_NETSTAT" and then other options (I added output formatting for instance). You can look up tasklist switches with tasklist /? – Casual Coder Sep 22 '10 at 10:21
2

You don't need Task Manager for tracking this. Just run netstat -b which will display the exe associated with the PID..

2
  • ...but then how to stop that process? – Arjan Aug 5 '15 at 18:15
  • @Arjan taskkill /f /im blah.exe – barlop Oct 15 '18 at 10:24
0

Some PID's you can see and some others you cannot. For example, I could not see PID=4 which is System. However I could see many others. Of course, I do not know the reason why. You can use the following command to see them. I have shown here a small portion of the output.


C:\Windows\system32>netstat -nao

Active Connections

  Proto  Local Address          Foreign Address        State           PID
  TCP    0.0.0.0:80             0.0.0.0:0              LISTENING       4
  TCP    0.0.0.0:135            0.0.0.0:0              LISTENING       840
  TCP    0.0.0.0:443            0.0.0.0:0              LISTENING       8112
  TCP    0.0.0.0:445            0.0.0.0:0              LISTENING       4
  TCP    0.0.0.0:554            0.0.0.0:0              LISTENING       7880
  TCP    0.0.0.0:1521           0.0.0.0:0              LISTENING       1080
  TCP    0.0.0.0:3389           0.0.0.0:0              LISTENING       1160
  TCP    0.0.0.0:3500           0.0.0.0:0              LISTENING       4
  TCP    0.0.0.0:5357           0.0.0.0:0              LISTENING       4
  TCP    0.0.0.0:6600           0.0.0.0:0              LISTENING       2216
  TCP    0.0.0.0:8080           0.0.0.0:0              LISTENING       1080
  TCP    0.0.0.0:8081           0.0.0.0:0              LISTENING       8112
  TCP    0.0.0.0:8090           0.0.0.0:0              LISTENING       4
  TCP    0.0.0.0:8093           0.0.0.0:0              LISTENING       3904
  TCP    0.0.0.0:18050          0.0.0.0:0              LISTENING       4
  TCP    0.0.0.0:30761          0.0.0.0:0              LISTENING       1968
  TCP    0.0.0.0:32843          0.0.0.0:0              LISTENING       4
  TCP    0.0.0.0:32844          0.0.0.0:0              LISTENING       4
  TCP    0.0.0.0:49152          0.0.0.0:0              LISTENING       544
  TCP    0.0.0.0:49153          0.0.0.0:0              LISTENING       1012
  TCP    0.0.0.0:49154          0.0.0.0:0              LISTENING       648
  TCP    0.0.0.0:49155          0.0.0.0:0              LISTENING       380
  TCP    0.0.0.0:49156          0.0.0.0:0              LISTENING       1484
  TCP    0.0.0.0:49202          0.0.0.0:0              LISTENING       700
2
  • You hadn't clicked "show processes from all users" then you'd see the processes with PID=4 in task manager. – barlop Feb 4 '20 at 18:00
  • also you'd know that if you'd read the other answers, like my one from 2010 – barlop Feb 4 '20 at 18:01
0

go to http://live.sysinternals.com/ and download procexp.exe (process explorer) this will provide you with all the relevant details.

otheriwse you can find it in task manager by viewing the column for process ID

0

It is clear from comment that this whole question is a complete nonsense. There is one issue if a person can't see PIDs. And another issue if a person can't see a process listed. Each has a simple solution. And one could have both those issues together. If you can't see PIDs, then you choose the option for the PID column. And if you can't see a process listed then you click to show processes from all users.

There no such issue of not being able to see the PID of a particular process. The questioner is simply not describing things properly.

To elaborate.- I'm going to first answer the question for what it says. But a comment suggests that the questioner is not describing things well and actually he can't see the process listed at all (not just he can't see the PID), and that's because he hasn't clicked the button in task manager to show processes from all users to make it show all processes.

For the question of if somebody can't see the PIDs.

To see PID numbers in task manager, first CTRL-SHIFT+ESC will bring up task manager (this is quicker than ctrl-alt-delete).

To show the PID of each process, click view->choose columns->pid and click ok

PID is the second item in the list of columns you can select.

In the questioner's case, he can't see the process, he should click "show processes from all users" Then he will see the process and of course, with PID.

The Questioner could use the tasklist command which is in the accepted answer, or he could simply use task manager and click that mentioned button.

Bear in mind though that he won't be able to kill the process with PID 4, which is the PID of the process he is looking for info on.

9
  • 2
    This does not answer the question. The OP said that some PID's seen in netstat does not show up in taskmanager. The question is what happened to those missing PID's. – Stefan Oct 15 '18 at 7:59
  • @Stefan no the OP said he saw some processes PIDs in netstat, and he can't see their PIDs in task manager. He didn't say that in task manager he sees PIDs for some processes and not others (And if he had heant that then i've never even heard of such a problem, it's questionable whether such a problem even exists, is that what you think he meant? you could say the OP was ambiguous). – barlop Oct 15 '18 at 10:23
  • 3
    No, you are incorrect. He said "When I checked it in my Task Manager, I couldn't find THOSE PID numbers." And yes, the problem does exist - that is the reason I found this thread - because that is exactly what happened to me. It would be very, much more strange if the problem was that he could not view the PID column in task manager. THAT is something I would never have heard about :) – Stefan Oct 15 '18 at 14:08
  • @Stefan I know he said he couldn't find those PID numbers, that may be because he can't see any. To give you an example, I just looked up task manager on youtube and both examples I saw, one for Win XP and one for Win7, both aren't showing PID so it's a really classic 'issue' for task manager to not be showing PID (was probably a default in XP and possibly even in 7 judging by the following pic), i.imgur.com/E6TtgVc.png Please show a pic Please include a link to a pic showing what you describe of some process IDs showing and some not showing 'cos i've never seen that before. – barlop Oct 15 '18 at 21:42
0

For those who try to make sense from netstat -o. It just report invalid PID. Don't try to make any sense from -o option. It is unreliable.

I reproduce issue 100% with Cygwin:

cygrunsrv -I lighttpd -t manual -p /usr/sbin/lighttpd.exe --args "-f /etc/lighttpd/lighttpd.conf" -c / -d "Lighttpd" -f "Local lighttpd"

sc start lighttpd

ps -a | grep lighttpd
     3989       1    3988      23104  ?             18 12:07:30 /usr/sbin/lighttpd

NETSTAT -a -n -o | grep :80
  TCP    [::]:80                [::]:0                 LISTENING       28916

tasklist /FI "PID eq 28916" /FO TABLE
INFO: No tasks are running which match the specified criteria.

kill 3988

NETSTAT -a -n -o | grep :80
### EMPTY!!!!!!

Probably cygwin.dll do some magic with PID which confuses netstat -o.

I have no luck with -b either:

netstat -natbo

  TCP    [::]:80                [::]:0                 LISTENING       14220
 [System]

What is [System]? Actually it is Cygwin's Lighttpd run as system service with different PID ))

So there is a bug in Windows netstat implementation.

PS I'm on Win 10 ver 2004 build 10.0.19041.867 (March 2021).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.