Finding which Windows process uses what IP socket

To find out which application uses what IP port on a Windows, both open listening sockets and open connections, you can use netstat with some options and then grep for the port number, or findstr as it’s called in Windows world.

netstat -ano | findstr “:xxxx”

This outputs something like this:

Aktive tilkoblinger

  Prot. Lokal adresse          Ekstern adresse          Tilstand           PID
  TCP    0.0.0.0:135            0.0.0.0:0              LISTENING       1232
  TCP    0.0.0.0:445            0.0.0.0:0              LISTENING       4
  TCP    0.0.0.0:17500          0.0.0.0:0              LISTENING       3500
  TCP    10.1.1.100:139         0.0.0.0:0              LISTENING       4
  TCP    10.1.1.100:1051        10.1.1.1:443           CLOSE_WAIT      3500
  TCP    10.1.1.189:1052        199.47.216.148:80      ESTABLISHED     3500

In the right column you’ll find the PID of the process using the socket. Open task manager, make sure the PID column is visible (might need to add it to the view, then look around in the drop down menus).

Source: http://www.windowsnetworking.com/kbase/WindowsTips/WindowsServer2008/AdminTips/Network/DeterminingwhatserviceorapplicationownsaTCPport.html