netstat Command: Find Ports, Connections and PIDs (2026)

Verified June 2026 · tested on Windows 11 24H2, Windows 10 22H2 & Server 2022/2025

Quick Reference: Essential Commands

The single most-asked-for task — find the process using a port — is the first block below.

# 1. Find which PID owns a port (e.g. 8080)
netstat -ano | findstr :8080

# 2. Look up that PID's executable (use the PID from step 1)
tasklist /FI "PID eq 1234"

# All connections + listening ports, numeric, with PID
netstat -ano

# Only listening ports
netstat -ano | findstr LISTENING

# Show the owning executable name (requires Administrator)
netstat -anb

# Routing table / per-protocol stats / adapter stats
netstat -r
netstat -s
netstat -e

# PowerShell equivalent of netstat -ano
Get-NetTCPConnection -State Listen |
    Select-Object LocalAddress,LocalPort,State,OwningProcess

Which netstat task do you need?

• Find the process using a port → netstat -ano + findstr
• See the executable name behind a connection → netstat -b
• View the routing table → netstat -r
• Protocol statistics (TCP/UDP/ICMP) → netstat -s
• Adapter / Ethernet counters → netstat -e
• Do it the PowerShell way → Get-NetTCPConnection

Jump to the section you need below.

netstat -ano: Find the PID Using a Port

This is the command most people actually came for. netstat -ano lists every TCP and UDP endpoint with the owning process ID (PID) in the last column, then you map that PID to a name with tasklist.

Windows 10Windows 11Server 2016+Built in — no module

What each letter means

The two-step workflow

# Step 1 — find the PID that owns the port (TCP 8080 here)
netstat -ano | findstr :8080
#   TCP    0.0.0.0:8080    0.0.0.0:0    LISTENING    1234
#                                                     ^^^^  <- the PID

# Step 2 — resolve that PID to an executable
tasklist /FI "PID eq 1234"
#   Image Name        PID    Session Name    Session#    Mem Usage
#   node.exe          1234   Console         1           120,480 K

A few refinements that make this faster in practice:

# Match the port precisely (the colon avoids matching 18080, 8081, etc.)
netstat -ano | findstr ":8080 "

# Only TCP listeners on that port
netstat -ano -p TCP | findstr LISTENING | findstr :8080

# One-liner: filter to a port, then pipe the PID column to tasklist
for /f "tokens=5" %p in ('netstat -ano ^| findstr :8080') do tasklist /FI "PID eq %p"

Tip: PID 0 is the System Idle Process and PID 4 is the System kernel process — both legitimately own ports (4 typically owns SMB 445 and, on a server, HTTP 80 via http.sys). You cannot and should not kill them.

Once you have identified the offending PID and confirmed what it is, you can free the port:

# Force-terminate the process holding the port
taskkill /PID 1234 /F

Warning: taskkill /F (and PowerShell's Stop-Process -Force) kills the process immediately with no chance to save state. Always confirm the PID with tasklist /FI "PID eq <PID>" first — killing the wrong PID (a database, a domain service, or PID 4) can corrupt data or crash the machine.

netstat -b: Show the Owning Executable

-b skips the PID-lookup dance and prints the executable — and the DLLs it loaded — directly under each connection. The trade-off: it needs elevation and is slow, because Windows inspects every process.

Windows 10Windows 11Server 2016+⚠ Requires Administrator

# Run from an ELEVATED prompt. Combine with -a and -n as usual.
netstat -anb

# Add the PID column too, and filter to one port
netstat -anob | findstr :443

# Resolve remote endpoints to FQDNs (slower — does reverse DNS)
netstat -anbf

Note: If netstat -b returns "The requested operation requires elevation," you are not running as Administrator. Re-launch the terminal with Run as administrator. When you only need one port, filter with findstr so -b does not crawl every process.

netstat -r: Routing Table

netstat -r prints the IPv4 and IPv6 routing table — the same output as route print. It shows how the machine decides where to send each packet, including the default gateway (0.0.0.0).

Windows 10Windows 11Server 2016+No elevation needed

# Full routing table (IPv4 + IPv6) plus the interface list
netstat -r

# Find your default gateway quickly
netstat -r | findstr 0.0.0.0

# PowerShell equivalent
Get-NetRoute -AddressFamily IPv4 | Sort-Object RouteMetric

The output has three parts: an Interface List (each adapter and its index), the Active Routes table (destination, netmask, gateway, interface, metric), and Persistent Routes (routes added with route -p add that survive reboots).

netstat -s: Per-Protocol Statistics

-s shows cumulative statistics per protocol — packet counts, errors, resets, and discards for IP, ICMP, TCP, and UDP. It is the go-to for spotting retransmissions, failed connections, or a flood of discarded packets.

Windows 10Windows 11Server 2016+No elevation needed

# All protocol statistics
netstat -s

# TCP only — look for "Failed Connection Attempts" and "Segments Retransmitted"
netstat -s -p tcp

# UDP datagram counts (received errors are a clue to dropped packets)
netstat -s -p udp

Note: These counters are cumulative since the last reboot, not a live rate. To watch them change, append an interval (in seconds): netstat -s -p tcp 5 reprints the stats every 5 seconds until you press Ctrl+C.

netstat -e: Interface Statistics

-e reports Ethernet/interface-level counters: total bytes and packets sent and received, plus errors, discards, and unknown protocols. It answers "is this NIC seeing errors?" at a glance.

Windows 10Windows 11Server 2016+No elevation needed

# Adapter byte/packet/error counters
netstat -e

# More detail by pairing -e with -s
netstat -e -s

# Refresh every 5 seconds (Ctrl+C to stop)
netstat -e 5

Non-zero values in the Errors or Discards columns point at cabling, driver, or duplex-mismatch problems — clean links should sit at or near zero.

Get-NetTCPConnection: the PowerShell Way

On Windows 8 / Server 2012 and later, the NetTCPIP module gives you Get-NetTCPConnection, which returns objects you can filter, sort, and join — far easier to script than parsing netstat's text.

Windows 8 / Server 2012+NetTCPIP module (built in)TCP only

# Equivalent of: netstat -ano | findstr :8080  (then tasklist)
Get-NetTCPConnection -LocalPort 8080 |
    Select-Object LocalAddress,LocalPort,State,OwningProcess

# Resolve the port to a process name in one pipeline
Get-NetTCPConnection -LocalPort 8080 |
    ForEach-Object { Get-Process -Id $_.OwningProcess }

# All listening TCP ports with the owning process name
Get-NetTCPConnection -State Listen |
    Select-Object LocalPort,
        @{Name='Process';Expression={(Get-Process -Id $_.OwningProcess).ProcessName}} |
    Sort-Object LocalPort

# UDP isn't covered by Get-NetTCPConnection — use this for listeners
Get-NetUDPEndpoint | Select-Object LocalAddress,LocalPort,OwningProcess

Note: Get-NetTCPConnection only handles TCP. For UDP endpoints use Get-NetUDPEndpoint, and remember UDP has no "LISTENING" state — a UDP socket is simply bound to a port.

Troubleshooting: Common netstat Errors & Gotchas

Each row is deep-linkable — share a specific issue with …#ns-elevation, and the row highlights on arrival.

Version & Compatibility Notes

• Windows 10 / 11 / Server: netstat -ano, -anb, -r, -s, and -e are identical across all modern Windows versions — no module or install required.
• -b and -f: Both exist on Windows Vista and later. -b always needs elevation; -f (FQDN resolution) was added in Vista and is safe but slower.
• PowerShell cmdlets: Get-NetTCPConnection and Get-NetUDPEndpoint ship with the NetTCPIP module on Windows 8 / Server 2012 and later — no RSAT needed. They cover TCP and UDP respectively but not the routing table; use Get-NetRoute for that.
• Live refresh: Any netstat command accepts a trailing interval in seconds (e.g. netstat -ano 5) to reprint continuously until Ctrl+C — handy for watching a connection appear or drop.
• Linux / macOS: The Windows -ano/-anb switches do not apply. On Linux prefer ss -tulpn; on macOS use BSD netstat -anv plus lsof -i :PORT to map a port to a process.