How do I find out which process is listening on a TCP or UDP port on Windows?
How do I find out which process is listening on a TCP or UDP port on Windows?
Get-Process -Id (Get-NetTCPConnection -LocalPort YourPortNumberHere).OwningProcess
Get-Process -Id (Get-NetUDPEndpoint -LocalPort YourPortNumberHere).OwningProcess
C:\> netstat -a -b
(Add -n to stop it trying to resolve hostnames, which will make it a lot faster.)
Note Dane's recommendation for TCPView. It looks very useful!
-a Displays all connections and listening ports.
-b Displays the executable involved in creating each connection or listening port. In some cases well-known executables host multiple independent components, and in these cases the sequence of components involved in creating the connection or listening port is displayed. In this case the executable name is in [] at the bottom, on top is the component it called, and so forth until TCP/IP was reached. Note that this option can be time-consuming and will fail unless you have sufficient permissions.
-n Displays addresses and port numbers in numerical form.
-o Displays the owning process ID associated with each connection.
Use TCPView if you want a GUI for this. It's the old Sysinternals application that Microsoft bought out.
The -b switch mentioned in most answers requires you to have administrative privileges on the machine. You don't really need elevated rights to get the process name!
Find the pid of the process running in the port number (e.g., 8080)
netstat -ano | findStr "8080"
Find the process name by pid
tasklist /fi "pid eq 2216"
To find out which specific process (PID) is using which port:
netstat -anon | findstr 1234
Where 1234 is the PID of your process. [Go to Task Manager → Services/Processes tab to find out the PID of your application.]
In case someone need an equivalent for macOS like I did, here is it:
lsof -i tcp:8080
After you get the PID of the process, you can kill it with:
kill -9 <PID>
Open the command prompt - start → Run → cmd, or start menu → All Programs → Accessories → Command Prompt.
Type
netstat -aon | findstr '[port_number]'
Replace the [port_number] with the actual port number that you want to check and hit Enter.
Type
tasklist | findstr '[PID]'
Replace the [PID] with the number from the above step and hit Enter.
Netstat:
-o owning process
netstat -bano | findstr "7002"
netstat -ano > ano.txt
The Currports tool helps to search and filter
A single-line solution that helps me is this one. Just substitute 3000 with your port:
$P = Get-Process -Id (Get-NetTCPConnection -LocalPort 3000).OwningProcess; Stop-Process $P.Id
Edit: Changed kill to Stop-Process for more PowerShell-like language
To find pid who using port 8000
netstat -aon | findstr '8000'
To Kill that Process in windows
taskkill /pid pid /f
where pid is the process id which you get form first command
Programmatically, you need stuff from iphlpapi.h, for example GetTcpTable2(). Structures like MIB_TCP6ROW2 contain the owner PID.
You can also check the reserved ports with the command below. Hyper-V reserve some ports, for instance.
netsh int ipv4 show excludedportrange protocol=tcp
if you want to have a good overview, you can use this:
Get-NetTCPConnection -State Listen | Select-Object -Property *, `
@{'Name' = 'ProcessName';'Expression'={(Get-Process -Id $_.OwningProcess).Name}} `
| select ProcessName,LocalAddress,LocalPort
than you get a table like this:
ProcessName LocalAddress LocalPort
----------- ------------ ---------
services :: 49755
jhi_service ::1 49673
svchost :: 135
services 0.0.0.0 49755
spoolsv 0.0.0.0 49672
for udp it is:
Get-NetUDPEndpoint | Select-Object -Property *, `
@{'Name' = 'ProcessName';'Expression'={(Get-Process -Id $_.OwningProcess).Name}} `
| select ProcessName,LocalAddress,LocalPort
Use the below batch script which takes a process name as an argument and gives netstat output for the process.
@echo off
set procName=%1
for /f "tokens=2 delims=," %%F in ('tasklist /nh /fi "imagename eq %1" /fo csv') do call :Foo %%~F
goto End
:Foo
set z=%1
echo netstat for : "%procName%" which had pid "%1"
echo ----------------------------------------------------------------------
netstat -ano |findstr %z%
goto :eof
:End
Based on answers with info and kill, for me it is useful to combine them in one command. And you can run this from cmd to get information about process that listen on given port (example 8080):
for /f "tokens=3 delims=LISTENING" %i in ('netstat -ano ^| findStr "8080" ^| findStr "["') do @tasklist /nh /fi "pid eq %i"
Or if you want to kill it:
for /f "tokens=3 delims=LISTENING" %i in ('netstat -ano ^| findStr "8080" ^| findStr "["') do @Taskkill /F /IM %i
You can also put those command into a bat file (they will be slightly different - replace %i for %%i):
portInfo.batfor /f "tokens=3 delims=LISTENING" %%i in (
'netstat -ano ^| findStr "%1" ^| findStr "["'
) do @tasklist /nh /fi "pid eq %%i"
portKill.batfor /f "tokens=3 delims=LISTENING" %%i in (
'netstat -ano ^| findStr "%1" ^| findStr "["'
) do @Taskkill /F /IM %%i
Then you from cmd you can do this:
portInfo.bat 8080
or
portKill.bat 8080