i tried running netstat -o to check what are the connections which are established. I saw two and they have PID numbers. When I checked it in my Task Manager, I couldn't find those PID numbers.
Is there any way to find them?
-
Have you selected the "show processes from all users" button/checkbox? Presumably you're running Windows - what version? – DMA57361 Sep 22 '10 at 8:01
-
Is it possible that the tasks have simply terminated between the netstat and the launch of Task Manager? – harrymc Sep 22 '10 at 8:24
-
@DMA5736: how can i show all processes from all users? i'm running windows 7 – tintincutes Sep 22 '10 at 10:11
-
Press the button indicated in this image, as found here (because I'm not on a Win7 machine at the moment to make my own screenshot). – DMA57361 Sep 22 '10 at 10:33
-
@DMA5736: i saw it and the other PID represent the spooler subsystem app. and the number 4 represents for the "System" not sure what they are doing in my PC as they represent established. I was suspecting that this might a keylogger or so... – tintincutes Sep 22 '10 at 10:56
|
Show 2 more comments
For example:
tasklist /FI "PID eq 736" /FO TABLE
Best tools to investigate Win processes I know about are from Sysinternals
Try using Process Explorer or TcpView
-
-
1Yes, this is command line tool. Of course change the number of process id. – Casual Coder Sep 22 '10 at 8:36
-
-
does that mean i write it like this: "tasklist /FI "4 eq 736" /FO TABLE"... where did you get the 736? – tintincutes Sep 22 '10 at 10:11
-
Sorry, I've made typo. Filter should be "PID eq 736". 736 is example PID number. Ok, you obtain your pid that you would like to investigate further (with netstat -ao I've assumed). Then you type: tasklist /FI "PID eq YOUR_PID_NO_FROM_NETSTAT" and then other options (I added output formatting for instance). You can look up tasklist switches with
tasklist /?– Casual Coder Sep 22 '10 at 10:21
You don't need Task Manager for tracking this. Just run netstat -b which will display the exe associated with the PID..
Some PID's you can see and some others you cannot. For example, I could not see PID=4 which is System. However I could see many others. Of course, I do not know the reason why. You can use the following command to see them. I have shown here a small portion of the output.
C:\Windows\system32>netstat -nao Active Connections Proto Local Address Foreign Address State PID TCP 0.0.0.0:80 0.0.0.0:0 LISTENING 4 TCP 0.0.0.0:135 0.0.0.0:0 LISTENING 840 TCP 0.0.0.0:443 0.0.0.0:0 LISTENING 8112 TCP 0.0.0.0:445 0.0.0.0:0 LISTENING 4 TCP 0.0.0.0:554 0.0.0.0:0 LISTENING 7880 TCP 0.0.0.0:1521 0.0.0.0:0 LISTENING 1080 TCP 0.0.0.0:3389 0.0.0.0:0 LISTENING 1160 TCP 0.0.0.0:3500 0.0.0.0:0 LISTENING 4 TCP 0.0.0.0:5357 0.0.0.0:0 LISTENING 4 TCP 0.0.0.0:6600 0.0.0.0:0 LISTENING 2216 TCP 0.0.0.0:8080 0.0.0.0:0 LISTENING 1080 TCP 0.0.0.0:8081 0.0.0.0:0 LISTENING 8112 TCP 0.0.0.0:8090 0.0.0.0:0 LISTENING 4 TCP 0.0.0.0:8093 0.0.0.0:0 LISTENING 3904 TCP 0.0.0.0:18050 0.0.0.0:0 LISTENING 4 TCP 0.0.0.0:30761 0.0.0.0:0 LISTENING 1968 TCP 0.0.0.0:32843 0.0.0.0:0 LISTENING 4 TCP 0.0.0.0:32844 0.0.0.0:0 LISTENING 4 TCP 0.0.0.0:49152 0.0.0.0:0 LISTENING 544 TCP 0.0.0.0:49153 0.0.0.0:0 LISTENING 1012 TCP 0.0.0.0:49154 0.0.0.0:0 LISTENING 648 TCP 0.0.0.0:49155 0.0.0.0:0 LISTENING 380 TCP 0.0.0.0:49156 0.0.0.0:0 LISTENING 1484 TCP 0.0.0.0:49202 0.0.0.0:0 LISTENING 700
go to http://live.sysinternals.com/ and download procexp.exe (process explorer) this will provide you with all the relevant details.
otheriwse you can find it in task manager by viewing the column for process ID
It is clear from comment that this whole question is a complete nonsense. There is one issue if a person can't see PIDs. And another issue if a person can't see a process listed. Each has a simple solution. And one could have both those issues together. If you can't see PIDs, then you choose the option for the PID column. And if you can't see a process listed then you click to show processes from all users.
There no such issue of not being able to see the PID of a particular process. The questioner is simply not describing things properly.
To elaborate.- I'm going to first answer the question for what it says. But a comment suggests that the questioner is not describing things well and actually he can't see the process listed at all (not just he can't see the PID), and that's because he hasn't clicked the button in task manager to show processes from all users to make it show all processes.
For the question of if somebody can't see the PIDs.
To see PID numbers in task manager, first CTRL-SHIFT+ESC will bring up task manager (this is quicker than ctrl-alt-delete).
To show the PID of each process, click view->choose columns->pid and click ok
PID is the second item in the list of columns you can select.
In the questioner's case, he can't see the process, he should click "show processes from all users" Then he will see the process and of course, with PID.
The Questioner could use the tasklist command which is in the accepted answer, or he could simply use task manager and click that mentioned button.
Bear in mind though that he won't be able to kill the process with PID 4, which is the PID of the process he is looking for info on.
-
2This does not answer the question. The OP said that some PID's seen in netstat does not show up in taskmanager. The question is what happened to those missing PID's. – Stefan Oct 15 '18 at 7:59
-
@Stefan no the OP said he saw some processes PIDs in netstat, and he can't see their PIDs in task manager. He didn't say that in task manager he sees PIDs for some processes and not others (And if he had heant that then i've never even heard of such a problem, it's questionable whether such a problem even exists, is that what you think he meant? you could say the OP was ambiguous). – barlop Oct 15 '18 at 10:23
-
3No, you are incorrect. He said "When I checked it in my Task Manager, I couldn't find THOSE PID numbers." And yes, the problem does exist - that is the reason I found this thread - because that is exactly what happened to me. It would be very, much more strange if the problem was that he could not view the PID column in task manager. THAT is something I would never have heard about :) – Stefan Oct 15 '18 at 14:08
-
@Stefan I know he said he couldn't find those PID numbers, that may be because he can't see any. To give you an example, I just looked up task manager on youtube and both examples I saw, one for Win XP and one for Win7, both aren't showing PID so it's a really classic 'issue' for task manager to not be showing PID (was probably a default in XP and possibly even in 7 judging by the following pic), i.imgur.com/E6TtgVc.png Please show a pic Please include a link to a pic showing what you describe of some process IDs showing and some not showing 'cos i've never seen that before. – barlop Oct 15 '18 at 21:42
-
For those who try to make sense from netstat -o. It just report invalid PID. Don't try to make any sense from -o option. It is unreliable.
I reproduce issue 100% with Cygwin:
cygrunsrv -I lighttpd -t manual -p /usr/sbin/lighttpd.exe --args "-f /etc/lighttpd/lighttpd.conf" -c / -d "Lighttpd" -f "Local lighttpd"
sc start lighttpd
ps -a | grep lighttpd
3989 1 3988 23104 ? 18 12:07:30 /usr/sbin/lighttpd
NETSTAT -a -n -o | grep :80
TCP [::]:80 [::]:0 LISTENING 28916
tasklist /FI "PID eq 28916" /FO TABLE
INFO: No tasks are running which match the specified criteria.
kill 3988
NETSTAT -a -n -o | grep :80
### EMPTY!!!!!!
Probably cygwin.dll do some magic with PID which confuses netstat -o.
I have no luck with -b either:
netstat -natbo
TCP [::]:80 [::]:0 LISTENING 14220
[System]
What is [System]? Actually it is Cygwin's Lighttpd run as system service with different PID ))
So there is a bug in Windows netstat implementation.
PS I'm on Win 10 ver 2004 build 10.0.19041.867 (March 2021).
