How to find what application is listening on a TCP/IP port in windows using netstat?

Whenever an application wants to make itself accessible over the network, it claims a TCP/IP port, which means that port can’t be used by anything else. So if you need to use an in-use port, how do you tell what application is holding it?

There’s a number of ways to tell which application has the port locked, here we will use a windows built-in way using the command line and Task Manager.

Using Built-In Tools to See What is Listening on a Port

The first step is to use a command-line tool to see what ports are in use, and use a special flag that tells us which port is assigned to each Windows process identifier number. Then we can use that number to look up exactly which process it is.

Open up a command prompt and type in the following—you may have to open in Administrator mode to see all processes:

p1

netstat -ab | more

This will immediately show you a list, although it’s maybe a little complicated. You’ll see the process name in the list, and you can search for it.

p4

You can also use this other method, which takes an extra step, but makes it easier to locate the actual process:


netstat -aon | more

If you look on the right-hand side, you’ll see where I’ve highlighted the list of PIDs, or Process Identifiers. Find the one that’s bound to the port that you’re trying to troubleshoot—for this example, you’ll see that 0.0.0.0:80, or port 80, is in use by PID 1184.

p2

Now you can simply open up Task Manager—you might have to use the option to Show Processes for All Users, and then you’ll be able to find the PID in the list. Once you’re there, you can use the End Process, Open File Location, or Go to Service(s) options to control the process or stop it.

p5

Alternatively you can even use resource monitor to stop any process that is running. To open resource monitor type resmon.exe in run. This will bring up the resource monitor window.

p6

p3

There would be situations were some other process is running at port 80. To stop anything running in port 80 the following command can be used from command prompt.

net stop http /y