I am guessing that netstat shows apps and their ports that already have a connection and it doesn't show or can't show an app that is trying to open a connection.

If I have an app that's trying to connect to the net but is blocked by a firewall, how do I know which port it's trying to use?

  • For what operating system? Sep 2, 2009 at 19:52
  • Sorry.. for Windows Sep 2, 2009 at 19:57

5 Answers 5


You can use TCPView from Microsoft/Sysinternals.


If you find it difficult to capture the port opening with that utility, than the best bet is to install and run Wireshark to get a network trace (assume you aren't talking about a local software-based firewall.

  • TCP view is pretty much a frontend for netstat; if the program can't connect, I don't think you'll see in in that. Wireshark is what you want.
    – Dentrasi
    Sep 2, 2009 at 20:23
  • 1
    That depends. If the firewall is not closing the connection (just dropping packets), then TCPView will show SYN_SENT while it waits for the connection to be established. You can see the same in netstat, but you have to be quicker on the refresh.
    – dlux
    Sep 2, 2009 at 20:35

Windows tool to find out which port an app is trying to use?

NirSoft's CurrPorts - network monitoring software that displays the list of all currently opened TCP/IP and UDP ports on your local computer. For each port in the list, information about the process that opened the port is also displayed, including the process name, full path of the process, version information of the process (product name, file description, and so on), the time that the process was created, and the user that created it.

enter image description here

CurrPorts allows you to close unwanted TCP connections, kill the process that opened the ports, and save the TCP/UDP ports information to HTML file , XML file, or to tab-delimited text file. CurrPorts also automatically mark with pink color suspicious TCP/UDP ports owned by unidentified applications (Applications without version information and icons)


If it's a software firewall then make an exception for the whole application so that you can easily check with netstat or tcpview which port it's using. After that you can remove the exception and add a rule for that specific port

  • Can't do that. It's a firewall at work which I don't have access to. Sep 2, 2009 at 20:22

From the command line you can use

netstat -ano

Then look at the Task Manager to see which PID corresponds to which port

  • Tried that and it didn't work thus my question. I ran a program which was trying to connect to the net and then the netstat command and tasklist | findstr pid and the app didn't show up. My conclusion is netstat shows established connections only. Sep 3, 2009 at 4:21

netstat -b -a

seems to work

-a Displays all connections and listening ports.

-b Displays the executable involved in creating each connection or listening port. In some cases well-known executables host multiple independent components, and in these cases the sequence of components involved in creating the connection or listening port is displayed. In this case the executable name is in [] at the bottom, on top is the component it called, and so forth until TCP/IP was reached. Note that this option can be time-consuming and will fail unless you have sufficient permissions.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.