Command: netstat -ano
The netstat
command stands for network statistics. It’s a versatile command-line utility that lets you monitor incoming and outgoing network connections, routing tables, interface statistics, masquerade connections, multicast memberships, and much more.
When paired with the -ano
switches, it performs the following functions:
-a
displays all active connections and the TCP/UDP ports on which the computer is listening.-n
displays addresses and port numbers in numerical form.-o
shows the process ID associated with each connection.
- Proto: The protocol (TCP or UDP) used by the connection.
- Local Address: The IP address of the local computer and the port number being used. An address of
0.0.0.0
means the port is listening on all network interfaces. - Foreign Address: The remote IP address and port number. If this is
0.0.0.0
or*:*
, the port is listening and not currently connected. - State: This indicates the state of a TCP connection. The states include LISTENING, ESTABLISHED, CLOSE_WAIT, etc.
- PID: The process identifier that’s using the port.
Use powershell
Get-NetTCPConnection | where {$_.State -eq "Listen"} |
ForEach-Object {
$process = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
[PSCustomObject]@{
LocalPort = $_.LocalPort
ProcessName = $process.Name
PID = $_.OwningProcess
}
} | Sort-Object ProcessName, LocalPort | Format-Table -Auto
0 Comments