If I want to find out what process is listening on what socket, I can use netstat/TCPview and will immediately see it. However, it is possible to bind to an address without listening. If this is done, it does not show up in netstat/TCPview, but does block the socket.

Python example:

import socket
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

The port is now bound, and attempting to execute the same code in a second instance while the first is still running will result in an error. However, unless you actually start listening on that port using


the port does not show up in netstat/TCPview.

The question is: Is it possible to see what ports are bound (but not listening), and which process is binding them?

The background of this is that I have had a moving range of 1976 ports that cannot be bound, and I want to know what causes this. In the meantime, I determined through trial and error that Internet Connection Sharing was blocking those ports, but I am still curious about the answer to this question.

Edit: Due to popular request, here is the code I used to find those ports:

import time
import socket

for i in range(0,65536):
        print "Listening on port", i, '...', 
        serversocket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        serversocket.bind(('', i))
        print "ok"
        print "FAIL"

(you may want to pipe the output to grep and filter for FAIL only)

  • You can loop this script from 0 to 65535, log the ports it fails on and compare the result with netstat ports. The ones not listed in netstat should be what you are looking for. I don't know of any tool or technique that will show you what process is behind those ports, unless it is listening.
    – Kedar
    Mar 15, 2013 at 9:15
  • @Kedar: That is exactly what I did to find out which ports are affected. Mar 15, 2013 at 14:53
  • @Lizz: Code posted. Mar 21, 2013 at 11:50
  • could you post it as the answer? would be good to have as reference :)
    – Lizz
    Mar 21, 2013 at 15:35
  • @Lizz: It is not an answer to the question. It shows which ports are affected, but not what is occupying them. Mar 21, 2013 at 23:32

3 Answers 3


I had to do this exact thing today. Powershell can do it with Get-NetTCPConnection.

PS C:\WINDOWS\system32> Get-NetTCPConnection -LocalPort 53100

LocalAddress                        LocalPort RemoteAddress                       RemotePort State       AppliedSetting OwningProcess
------------                        --------- -------------                       ---------- -----       -------------- -------------                             53100                             0          Bound                      40120

PS C:\WINDOWS\system32> get-process -PID 40120

Handles  NPM(K)    PM(K)      WS(K)     CPU(s)     Id  SI ProcessName
-------  ------    -----      -----     ------     --  -- -----------
   2133    1331    13884      30740  30,955.31  40120   1 HWMonitorPro

In recent versions of netstat there is now a command line parameter -q that shows those sockets.

$ netstat -?

Displays protocol statistics and current TCP/IP network connections.

NETSTAT [-a] [-b] [-e] [-f] [-n] [-o] [-p proto] [-r] [-s] [-x] [-t] [interval]

  -a            Displays all connections and listening ports.
  -b            Displays the executable involved in creating...
  -p proto      Shows connections for the protocol specified...
  -q            Displays all connections, listening ports, and bound
                nonlistening TCP ports. Bound nonlistening ports may or may not
                be associated with an active connection.
  -r            Displays the routing table.

Example of use:

$ netstat -nq -p tcp

Active Connections

  Proto  Local Address          Foreign Address        State
  TCP                  LISTENING
  TCP                  LISTENING
  TCP                 LISTENING

  TCP              BOUND
  TCP              BOUND
  TCP              BOUND
  TCP              BOUND

It seems there is no public API for getting the sockets in that situation. See my question in StackOverflow.

  • 1
    I thought that should work for me too! Except it didn't! I just now discovered that if you use the -b option to find the process name then -q doesn't show BOUND sockets.
    – Zan Lynx
    Jun 5, 2020 at 22:08

you should use

DWORD GetExtendedTcpTable (PVOID pTcpTable,PDWORD pdwSize, BOOL bOrder, ULONG ulAf, TCP_TABLE_CLASS TableClass,ULONG Reserved );



pTcpTable structure -> MIB_TCPTABLE_OWNER_PID

depending on the info you'd like to retrieve


TCP_TABLE_OWNER_PID_ALL returns MIB_TCPTABLE_OWNER_PID structure that is an array of MIB_TCPROW_OWNER_PID structures where each dwState should have MIB_TCP_STATE_CLOSED when bound and not listening, this structure also offers dwLocalAddr and dwLocalPort

typedef struct _MIB_TCPROW_OWNER_PID {
  DWORD dwState;
  DWORD dwLocalAddr;
  DWORD dwLocalPort;
  DWORD dwRemoteAddr;
  DWORD dwRemotePort;
  DWORD dwOwningPid;
  • This only lists sockets that are both bound and listening, but the question was specifically about sockets that are bound but not listening. Jan 4, 2018 at 8:30
  • are you asserting or asking??? see the edit
    – Pat
    Jan 4, 2018 at 10:27
  • When I run pastebin.com/vaHMVRQR I get nothing in the table for bind without listen (Win7) Jan 8, 2018 at 2:06
  • The involved structures have particular alignments, you should not re-define them; you should reference the ones that are defined by MS. Also if you want to initially test a MS API Python is not the right tool; you should use C/C++ instead.
    – Pat
    Jan 8, 2018 at 8:08
  • the code as displayed does not give information about sockets that are bound but unconnected; in recent versions of netstat there is now a command line parameter -q that shows those sockets
    – zentrunix
    Feb 10, 2019 at 9:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .