Paste netstat, ss or lsof output and see listening ports, active connections, process names and connections worth checking. Runs in your browser.
Netstat prints a long list of connections and leaves the reading to you. This analyzer takes the output from Windows, Linux or macOS and turns it into a table you can search and filter, with the process behind each port, plain-English explanations of each connection state, and a short list of things worth checking.
It reads netstat -ano and netstat -anob on Windows, ss and netstat on Linux, netstat -anv on macOS, and lsof output. One copy-and-paste command per system collects the machine name, its IP addresses and the connection list in a single step, so you do not have to remember the right flags.
Everything runs in your browser. The output you paste is never uploaded and never added to the page address, and the checks use only a bundled list of Tor exit nodes, so no address is looked up anywhere.
The usual question behind a netstat search is which program is holding a port. Each system has a quick answer.
Windows (Command Prompt): netstat -ano | findstr :8080 shows the line for the port, and the last number is the process ID. Then tasklist /FI "PID eq 1234" turns that ID into a program name.
Windows (PowerShell): Get-Process -Id (Get-NetTCPConnection -LocalPort 8080).OwningProcess does both steps at once.
Linux: sudo ss -tulpn | grep :8080 lists the listening socket with its process. sudo lsof -i :8080 works too.
macOS: sudo lsof -nP -iTCP:8080 -sTCP:LISTEN shows the process listening on the port.
The analyzer does this for every port in the output at once, so you can search by port, by process or by address.
Each row is one socket, and the columns are the same on every system, with small differences.
On a busy server, the client side of a connection uses a high, temporary port. The service port, such as 443 or 5432, is the one to look at.
LISTENING means waiting for incoming connections. ESTABLISHED is an active connection.
TIME_WAIT is the system keeping a record of a connection that just closed, so late packets are not mistaken for a new one. Lots of these are normal on a busy machine and usually clear by themselves within a few minutes.
CLOSE_WAIT means the other side closed the connection and the application on this machine has not closed its end. A pile of these that keeps growing usually points to an application that is not cleaning up its connections.
SYN_SENT is a connection attempt waiting for an answer. Many of them to one address often mean the host is unreachable or filtered. SYN_RECEIVED is a request that has arrived and a handshake that is not finished. Many of these can mean slow clients, or a flood of connection attempts.
FIN_WAIT_1, FIN_WAIT_2, LAST_ACK and CLOSING are the steps of a connection closing, and they normally pass quickly.
Windows has netstat built in. Use netstat -ano for addresses and process IDs, and add tasklist to turn the IDs into names.
Linux has moved to ss, which is faster and part of the iproute2 tools. The older netstat comes from the net-tools package, which is often not installed by default. The flags are similar: ss -tunap lists TCP and UDP sockets with their processes. Add sudo to see processes owned by other users.
macOS has the BSD version of netstat, and its flags differ from Linux. Here -p selects a protocol, not a process, and -v adds a process column. Use netstat -anv, or lsof -nP -i if you prefer. There is no ss on macOS.
The analyzer runs a few simple checks and lists what it finds as leads. A lead is not a finding. Each one has a legitimate explanation in some setups, and the notes say so.
No check means nothing is wrong, and a clean result does not prove everything is fine.
On Windows, run netstat -ano | findstr :PORT and then tasklist /FI "PID eq PID". On Linux, run sudo ss -tulpn | grep :PORT. On macOS, run sudo lsof -nP -iTCP:PORT -sTCP:LISTEN. Or paste the full output here and search for the port.
It lists every TCP and UDP socket with its local address, remote address, state and the process ID that owns it. The -a flag shows all sockets, -n shows numbers instead of names, which is faster, and -o adds the process ID.
ss is the newer Linux tool, and netstat is the older one. They show similar information, but ss is faster and is installed by default on current distributions, while netstat needs the net-tools package. On Windows only netstat exists, and macOS has its own BSD netstat.
It means the port is listening on all network interfaces, so other machines can reach it. 127.0.0.1 or ::1 means it listens only on this machine. For a service that only this machine needs, binding it to 127.0.0.1 is safer.
TIME_WAIT is the system keeping a record of a connection that closed recently. A busy web server or a script that opens many short connections will have many, and they clear by themselves. It only becomes a problem if you run out of local ports, which is rare.
CLOSE_WAIT means the other side has closed the connection and your application has not closed its end. A pile that keeps growing points to a bug where the application does not close its sockets. Restarting the application clears them for a while, but the fix is in the code.
The analysis runs entirely in your browser. The text is never uploaded, never added to the page address and never saved. It still contains internal addresses, so remove sensitive details before you share a screenshot.
On Linux and macOS you need sudo to see processes owned by other users. On Windows, netstat shows only the process ID, so add tasklist to the command to get names. Some rows, such as closing connections, genuinely have no owner.
Build netstat and Get-NetTCPConnection commands to find the process using a port and list connections.
Comprehensive database of common network ports and their associated services
Check IP reputation, detect VPNs/proxies, analyze geolocation, and assess threat scores for fraud prevention
Build tracert, pathping, traceroute and mtr commands to trace the path to any host.
Lookup geographic location, ISP, ASN, and network information for any IP address