How do I find which process is using a port?

Run netstat -ano | findstr :PORT to list connections on that port; the process ID is in the last column. Then run tasklist /FI "PID eq NUMBER" to see the program name. In PowerShell, Get-NetTCPConnection -LocalPort PORT does the same in one step.

What do the netstat connection states mean?

LISTENING means a service is waiting for connections on that port. ESTABLISHED is an active, open session. TIME_WAIT is a recently closed connection that is winding down, which is normal and clears on its own after a short timeout.

Why does netstat -b say access denied?

The -b flag reveals the executable that owns each connection, which requires administrator rights. Open Command Prompt or PowerShell as Administrator and run it again, or use -o instead to get just the process ID without elevation.

Is Get-NetTCPConnection better than netstat?

On modern Windows it is often more convenient. Get-NetTCPConnection returns structured objects you can sort, filter, and pipe directly to Get-Process to resolve the program name, whereas netstat returns plain text you have to parse with findstr and tasklist.

netstat Command Builder

netstat (network statistics) lists active TCP/UDP connections, listening ports, the routing table, and per-protocol counters. Its most common job today is answering one question: which process is using a port? This builder generates the right command for Command Prompt or modern PowerShell, where the Get-NetTCPConnection cmdlets have largely replaced the classic tool.

The flags that matter

Flag	Meaning
`-a`	Show all connections and listening ports
`-n`	Show addresses and ports numerically (no DNS, faster)
`-o`	Show the owning process ID (PID)
`-b`	Show the owning executable (needs Administrator)
`-r`	Show the routing table
`-s`	Show per-protocol statistics

Find what is using a port

The classic recipe combines netstat -ano with findstr to filter by port, then tasklist to name the PID:

netstat -ano | findstr :3389
tasklist /FI "PID eq 1234"

The first command lists every connection on port 3389 with its PID in the last column; the second resolves that PID to a program name. In PowerShell the equivalent is one line:

Get-NetTCPConnection -LocalPort 3389 | Select-Object LocalPort, State, OwningProcess

Other common tasks

All connections with PIDs: netstat -ano
Listening ports only: netstat -ano | findstr LISTENING
Connection with the owning program: netstat -anob (run as Administrator)
Routing table: netstat -r
Per-protocol stats: netstat -s -p tcp

Reading the output

Columns are protocol, local address:port, remote address:port, state, and PID. LISTENING means a server is waiting for connections on that port; ESTABLISHED is an active session; TIME_WAIT is a recently closed connection winding down (normal, not a leak). Always pair -o with a tasklist or Get-Process lookup so a bare PID becomes a real program name.

Common use cases

Port conflicts — an app fails to start because its port is taken; netstat -ano | findstr :PORT names the culprit so you can stop or reconfigure it.
Security checks — reviewing listening ports with netstat -ano | findstr LISTENING shows every service exposed on the machine, useful for spotting unexpected open ports.
Connection auditing — netstat -anob reveals which program opened each outbound connection, helping investigate suspicious or unexpected network activity.
Routing problems — netstat -r prints the routing table so you can confirm the default gateway and any static routes.

Tips and pitfalls

The -b flag requires an elevated prompt; without it you see only the PID.
Use -n to avoid slow reverse-DNS lookups when you just need numbers.
On modern Windows prefer the Get-NetTCPConnection cmdlets — they return objects you can sort, filter, and join to Get-Process directly.

netstat Command Builder