netstat - Check network connections
The netstat command is a network diagnostic command for Command Prompt. It displays current network connections, port usage, the routing table, and more.
Typical uses include checking for unexpected network connections, finding out whether a specific port is in use, and identifying the cause of network trouble.
With netstat you can also see which programs on your PC are communicating over the network and which ports they are listening on.
This article covers netstat from basic usage to advanced usage and troubleshooting.
Quick reference by purpose
Start with the command that fits your goal.
| Goal | Command |
|---|---|
| List listening ports with PIDs | netstat -ano | findstr LISTENING |
| Find what uses a specific port (e.g., 8080) | netstat -ano | findstr /c:":8080 " |
| Check established connections | netstat -ano | findstr ESTABLISHED |
| Show program names too | netstat -abno (administrator required) |
To find the program name from a PID, use tasklist /fi "PID eq 1234".
Basic usage of the netstat command
The basic usage is as follows.
netstatRun on its own with no options, it displays only the currently active TCP connections (listening ports and UDP are not shown).
For more detail, specify options.
netstat [-a] [-b] [-e] [-f] [-n] [-o] [-p protocol] [-q] [-r] [-s] [-t] [-x] [-y] [interval]Basic example
First, run netstat without options.
This output shows only active TCP connections.
The “State” column shows the state of each TCP connection. Common states include ESTABLISHED (connected), LISTENING (waiting for connections), and TIME_WAIT (closing).
Main options of the netstat command
netstat has many options. This section covers the ones used most often.
Show all connections: the -a option
-a shows all active connections plus ports in the listening (LISTENING) state.
中小企業経営者のためのRPA入門 RPA導入を成功させる方法
60分でわかる！ AIエージェント 超 入門
コマンドラインの黒い画面が怖いんです。
知識・才能ゼロでもらく～に月10万円稼ぐ! よくわかるAI副業超入門
With -a you can see which ports are waiting for connections.
To confirm that a web or database server started correctly, use netstat -a and check whether the relevant port (for example 80, 443, or 3306) is in the LISTENING state.
Skip name resolution: the -n option
-n shows addresses and port numbers numerically instead of converting them to names.
Because no name resolution is performed, it runs much faster, especially when there are many connections.
Show process IDs: the -o option
-o shows the process ID (PID) associated with each connection.
Once you know the PID, you can identify the program that is communicating. Check the PID column on the Details tab of Task Manager, or run tasklist /fi "PID eq 4512".
Checking the displayed PID with tasklist or Task Manager lets you identify the program that is communicating. This is useful for security monitoring.
Show executable names: the -b option
-b shows the name of the executable that created each connection or listening port.
To use the -b option, you must run Command Prompt as administrator.
This option is convenient because it shows directly which program is using the network. Resolving executable names takes time, so the output may take tens of seconds to finish.
Show statistics: the -s option
-s shows statistics for each protocol.
Statistics help with network performance analysis and troubleshooting.
Show the routing table: the -r option
-r displays the IP routing table.
Checking the routing table helps you understand how network packets are forwarded.
Useful option combinations
In practice, you usually combine several options.
The -ano combination
One of the most common combinations is netstat -ano.
This command gives you all of the following at once:
- All connections (
-a) - Fast display without name resolution (
-n) - Process IDs (
-o) to identify programs
When a network problem occurs, running netstat -ano first to get the big picture is effective.
The -abon combination
When running as administrator, the -abon combination is very useful.
It shows both the process ID and the executable name, giving you more detailed information.
Continuous monitoring
If you add a number to the netstat command, it refreshes the display at that interval in seconds.
Press Ctrl + C to stop continuous monitoring.
Practical examples
Find the process using a specific port
To find the process using a specific port number (for example 8080), combine netstat with the findstr command.
Searching for just :8080 would also match ports such as :80801. Using /c: makes findstr treat the trailing space as part of the search string (otherwise a space means OR), so use /c:":8080 ". This can also match a remote port 8080 in the Foreign Address column, so check the Local Address column.
Once you have the PID, tasklist /fi "PID eq 5432" shows the program name. To end the process, use taskkill /PID 5432.
Show only ESTABLISHED connections
To check only established connections:
Show only LISTENING ports
To check only the ports that are waiting for connections:
After starting a web or database server, get into the habit of running netstat -ano | findstr LISTENING to confirm the port is open.
Troubleshooting cases
Checking for a port conflict
When you get an error such as “port already in use”, netstat tells you which process is using that port.
For example, if starting a web server on port 80 fails:
You can see that the process with PID 3456 is using port 80.
Checking suspicious outbound connections
If you have security concerns, run netstat -ano | findstr ESTABLISHED as shown above to check connections to external hosts.
If there are connections to IP addresses you do not recognize, check the process with that PID and take action if necessary.
Web browsers and background programs talk to many external IP addresses, such as CDNs and cloud services, so an unfamiliar address is not necessarily malicious. Identify the program from its PID, and if you do not recognize it, scan it with security software.
Main connection states
It is important to understand the main TCP connection states shown in the netstat output.
| State | Description |
|---|---|
| LISTENING | Waiting for connections. A server is waiting for clients |
| ESTABLISHED | A connection is established and data can be exchanged |
| TIME_WAIT | Waiting after the connection was closed, before it is fully released |
| CLOSE_WAIT | The other side closed the connection and the local application has not closed it yet |
| SYN_SENT | A connection request has been sent |
| SYN_RECEIVED | A connection request has been received |
| FIN_WAIT_1 | Closing the connection (stage 1) |
| FIN_WAIT_2 | Closing the connection (stage 2) |
| LAST_ACK | The local side closed and is waiting for the last acknowledgment |
Many TIME_WAIT entries mean that many connections were opened and closed in a short time. This is normally harmless and they disappear after a while (about 2 minutes by default). On the other hand, if CLOSE_WAIT entries stay for a long time, the application may not be closing its connections.
Summary
This article covered the netstat command from basic to advanced usage.
Key points:
netstatis the basic command for checking network connections-ashows all connections-nskips name resolution for faster output-oshows process IDs-b(administrator) shows executable names- Combine with
findstrto filter by port or state
netstat is an essential tool for network troubleshooting and security monitoring. Use it regularly to get a feel for your network’s state.