netstat Command: Find Ports, Connections and PIDs (2026)

Need to know which process is hogging port 8080, or what is quietly listening on your machine? The netstat command maps open ports and live connections to the process IDs that own them — and once you have the PID, tasklist tells you exactly what it is.

Verified June 2026 · tested on Windows 11 24H2, Windows 10 22H2 & Server 2022/2025

Quick Reference: Essential Commands

The single most-asked-for task — find the process using a port — is the first block below.

# 1. Find which PID owns a port (e.g. 8080)
netstat -ano | findstr :8080

# 2. Look up that PID's executable (use the PID from step 1)
tasklist /FI "PID eq 1234"

# All connections + listening ports, numeric, with PID
netstat -ano

# Only listening ports
netstat -ano | findstr LISTENING

# Show the owning executable name (requires Administrator)
netstat -anb

# Routing table / per-protocol stats / adapter stats
netstat -r
netstat -s
netstat -e

# PowerShell equivalent of netstat -ano
Get-NetTCPConnection -State Listen |
    Select-Object LocalAddress,LocalPort,State,OwningProcess

Which netstat task do you need?

• Find the process using a port → netstat -ano + findstr
• See the executable name behind a connection → netstat -b
• View the routing table → netstat -r
• Protocol statistics (TCP/UDP/ICMP) → netstat -s
• Adapter / Ethernet counters → netstat -e
• Do it the PowerShell way → Get-NetTCPConnection

Jump to the section you need below.

netstat -ano: Find the PID Using a Port

This is the command most people actually came for. netstat -ano lists every TCP and UDP endpoint with the owning process ID (PID) in the last column, then you map that PID to a name with tasklist.

Windows 10Windows 11Server 2016+Built in — no module

What each letter means

The two-step workflow

# Step 1 — find the PID that owns the port (TCP 8080 here)
netstat -ano | findstr :8080
#   TCP    0.0.0.0:8080    0.0.0.0:0    LISTENING    1234
#                                                     ^^^^  <- the PID

# Step 2 — resolve that PID to an executable
tasklist /FI "PID eq 1234"
#   Image Name        PID    Session Name    Session#    Mem Usage
#   node.exe          1234   Console         1           120,480 K

A few refinements that make this faster in practice:

# Match the port precisely (the colon avoids matching 18080, 8081, etc.)
netstat -ano | findstr ":8080 "

# Only TCP listeners on that port
netstat -ano -p TCP | findstr LISTENING | findstr :8080

# One-liner: filter to a port, then pipe the PID column to tasklist
for /f "tokens=5" %p in ('netstat -ano ^| findstr :8080') do tasklist /FI "PID eq %p"

Tip: PID 0 is the System Idle Process and PID 4 is the System kernel process — both legitimately own ports (4 typically owns SMB 445 and, on a server, HTTP 80 via http.sys). You cannot and should not kill them.

Once you have identified the offending PID and confirmed what it is, you can free the port:

# Force-terminate the process holding the port
taskkill /PID 1234 /F

Warning: taskkill /F (and PowerShell's Stop-Process -Force) kills the process immediately with no chance to save state. Always confirm the PID with tasklist /FI "PID eq <PID>" first — killing the wrong PID (a database, a domain service, or PID 4) can corrupt data or crash the machine.

netstat -b: Show the Owning Executable

-b skips the PID-lookup dance and prints the executable — and the DLLs it loaded — directly under each connection. The trade-off: it needs elevation and is slow, because Windows inspects every process.

Windows 10Windows 11Server 2016+⚠ Requires Administrator

# Run from an ELEVATED prompt. Combine with -a and -n as usual.
netstat -anb

# Add the PID column too, and filter to one port
netstat -anob | findstr :443

# Resolve remote endpoints to FQDNs (slower — does reverse DNS)
netstat -anbf

Note: If netstat -b returns "The requested operation requires elevation," you are not running as Administrator. Re-launch the terminal with Run as administrator. When you only need one port, filter with findstr so -b does not crawl every process.

netstat -r: Routing Table

netstat -r prints the IPv4 and IPv6 routing table — the same output as route print. It shows how the machine decides where to send each packet, including the default gateway (0.0.0.0).

Windows 10Windows 11Server 2016+No elevation needed

# Full routing table (IPv4 + IPv6) plus the interface list
netstat -r

# Find your default gateway quickly
netstat -r | findstr 0.0.0.0

# PowerShell equivalent
Get-NetRoute -AddressFamily IPv4 | Sort-Object RouteMetric

The output has three parts: an Interface List (each adapter and its index), the Active Routes table (destination, netmask, gateway, interface, metric), and Persistent Routes (routes added with route -p add that survive reboots).

netstat -s: Per-Protocol Statistics

-s shows cumulative statistics per protocol — packet counts, errors, resets, and discards for IP, ICMP, TCP, and UDP. It is the go-to for spotting retransmissions, failed connections, or a flood of discarded packets.

Windows 10Windows 11Server 2016+No elevation needed

# All protocol statistics
netstat -s

# TCP only — look for "Failed Connection Attempts" and "Segments Retransmitted"
netstat -s -p tcp

# UDP datagram counts (received errors are a clue to dropped packets)
netstat -s -p udp

Note: These counters are cumulative since the last reboot, not a live rate. To watch them change, append an interval (in seconds): netstat -s -p tcp 5 reprints the stats every 5 seconds until you press Ctrl+C.

netstat -e: Interface Statistics

-e reports Ethernet/interface-level counters: total bytes and packets sent and received, plus errors, discards, and unknown protocols. It answers "is this NIC seeing errors?" at a glance.

Windows 10Windows 11Server 2016+No elevation needed

# Adapter byte/packet/error counters
netstat -e

# More detail by pairing -e with -s
netstat -e -s

# Refresh every 5 seconds (Ctrl+C to stop)
netstat -e 5

Non-zero values in the Errors or Discards columns point at cabling, driver, or duplex-mismatch problems — clean links should sit at or near zero.

Get-NetTCPConnection: the PowerShell Way

On Windows 8 / Server 2012 and later, the NetTCPIP module gives you Get-NetTCPConnection, which returns objects you can filter, sort, and join — far easier to script than parsing netstat's text.

Windows 8 / Server 2012+NetTCPIP module (built in)TCP only

# Equivalent of: netstat -ano | findstr :8080  (then tasklist)
Get-NetTCPConnection -LocalPort 8080 |
    Select-Object LocalAddress,LocalPort,State,OwningProcess

# Resolve the port to a process name in one pipeline
Get-NetTCPConnection -LocalPort 8080 |
    ForEach-Object { Get-Process -Id $_.OwningProcess }

# All listening TCP ports with the owning process name
Get-NetTCPConnection -State Listen |
    Select-Object LocalPort,
        @{Name='Process';Expression={(Get-Process -Id $_.OwningProcess).ProcessName}} |
    Sort-Object LocalPort

# UDP isn't covered by Get-NetTCPConnection — use this for listeners
Get-NetUDPEndpoint | Select-Object LocalAddress,LocalPort,OwningProcess

Note: Get-NetTCPConnection only handles TCP. For UDP endpoints use Get-NetUDPEndpoint, and remember UDP has no "LISTENING" state — a UDP socket is simply bound to a port.

Troubleshooting: Common netstat Errors & Gotchas

Each row is deep-linkable — share a specific issue with …#ns-elevation, and the row highlights on arrival.

Version & Compatibility Notes

• Windows 10 / 11 / Server: netstat -ano, -anb, -r, -s, and -e are identical across all modern Windows versions — no module or install required.
• -b and -f: Both exist on Windows Vista and later. -b always needs elevation; -f (FQDN resolution) was added in Vista and is safe but slower.
• PowerShell cmdlets: Get-NetTCPConnection and Get-NetUDPEndpoint ship with the NetTCPIP module on Windows 8 / Server 2012 and later — no RSAT needed. They cover TCP and UDP respectively but not the routing table; use Get-NetRoute for that.
• Live refresh: Any netstat command accepts a trailing interval in seconds (e.g. netstat -ano 5) to reprint continuously until Ctrl+C — handy for watching a connection appear or drop.
• Linux / macOS: The Windows -ano/-anb switches do not apply. On Linux prefer ss -tulpn; on macOS use BSD netstat -anv plus lsof -i :PORT to map a port to a process.