Windows · Guide
How to Check Network Connections and Open Ports on Windows
Short answer
Run netstat -ano in an elevated Command Prompt to list every listening port with the owning process ID, then match the PID in Task Manager. To scan another machine you own, use Nmap.
Requirements
- Windows 11 or Windows 10
- Administrator Command Prompt or PowerShell
- Optional: Nmap for scanning hosts you are authorised to test
- Optional: Wireshark for traffic content
Steps
1. List local listening ports
Open Command Prompt as administrator and run netstat -ano | findstr LISTENING. Each line shows the local address, port and the process ID that owns it.
2. Match a port to a program
Open Task Manager, enable the PID column on the Details tab, and find the matching ID. Get-Process -Id <pid> in PowerShell gives the same answer in one line.
3. See active outbound connections
Run netstat -ano without a filter, or Get-NetTCPConnection -State Established, to see what your PC is currently talking to and on which remote port.
4. Check whether a port is reachable from outside
A local listener is not the same as an open port. Test from another machine on the network with Test-NetConnection -ComputerName <host> -Port <port>, since the Windows Firewall may still block it.
5. Scan a host you own with Nmap
nmap -sT -p 1-1024 <host> reports which ports answer from the network side. Only scan machines you own or have written permission to test.
6. Interpret an unexpected listener
Note the process, its file path and its publisher before acting. Many high-numbered listeners belong to legitimate update services and remote-management components.
7. Inspect the traffic if the process is unclear
Start a Wireshark capture and filter on the port, for example tcp.port==8080, to see whether the traffic is local discovery noise or a genuine remote session.
Alternative methods
1. Use PowerShell exclusively
Get-NetTCPConnection -State Listen | Select LocalAddress,LocalPort,OwningProcess returns the same data in an object form you can sort and export.
2. Sweep the LAN with an IP scanner
Advanced IP Scanner and Angry IP Scanner list live hosts and common open ports across a subnet quickly, which is easier than scanning host by host.
Troubleshooting
netstat shows a PID of 4 or 0
PID 4 is the System process, which owns SMB file sharing and other kernel-level listeners. PID 0 is the idle process placeholder used for some reserved entries.
Nmap reports all ports filtered
A firewall is dropping probes silently. That is normal for a hardened host; try a scan from inside the same subnet before concluding the service is down.
The port is listening but the app cannot connect
Check whether the listener is bound to 127.0.0.1 only. A service bound to loopback is unreachable from other machines regardless of firewall rules.
Frequently asked questions
Is running Nmap legal?
Scanning your own networks and devices is normal administration. Scanning systems you do not own or have permission to test can breach computer-misuse laws and provider terms.
What is the difference between listening and open?
Listening describes a local process waiting for connections. Open describes a port that is actually reachable from another machine, which also depends on firewalls and routing.
Do I need Npcap for Nmap on Windows?
The Windows installer includes Npcap and it is required for raw-packet scan types. Basic TCP connect scans work without it.
Can I see which website a connection belongs to?
netstat shows IP addresses; use nslookup on the remote address, or capture the traffic in Wireshark, where TLS handshakes usually expose the server name.