Home » Internet » Use Netstat To See Listening Ports And PID In Windows 11

Internet

Use Netstat To See Listening Ports And PID In Windows 11

Geeksdigit Team

May 14, 2026

0 Views

SaveSavedRemoved 0

If you want to check which apps, services, or background processes are using your network in Windows 11, Netstat is one of the most useful built-in tools available. Short for “Network Statistics,” Netstat is a command-line utility that shows active connections, open ports, listening ports, protocol statistics, and the Process ID (PID) associated with each network activity.

For Windows 11 users, Netstat is especially valuable for troubleshooting suspicious connections, diagnosing internet issues, identifying malware behavior, checking server applications, or simply understanding what software is communicating over your network. Whether you are a beginner learning Windows networking or an advanced user managing multiple services, Netstat provides detailed information directly from Command Prompt without needing third-party software.

This guide explains how to use Netstat to view listening ports and PIDs in Windows 11 in a simple, detailed, and beginner-friendly way.

What Is Netstat In Windows 11?

Netstat is a built-in command-line networking tool included in Windows operating systems. It allows users to display:

• Active TCP connections
• Listening ports
• UDP connections
• Network interface statistics
• Routing tables
• Protocol statistics
• Process IDs for running services

In practical terms, Netstat helps you see which programs are waiting for incoming network traffic or actively communicating over the internet.

For example:

• Web servers often listen on port 80 or 443
• Remote Desktop may listen on port 3389
• Malware may open hidden ports
• Apps like browsers create multiple active outbound connections

By pairing port information with PID values, you can identify exactly which process is responsible.

Why Check Listening Ports And PID?

There are several important reasons to use Netstat:

Security Monitoring

You can detect unauthorized services or suspicious open ports.

Troubleshooting Network Problems

If a port is blocked or already in use, Netstat helps identify the responsible application.

Server Management

Useful for checking whether web servers, FTP servers, or custom applications are running properly.

Malware Detection

Some malicious software opens hidden communication channels.

Performance Monitoring

You can see how many connections are active and which processes are consuming network resources.

Understanding Ports And PID

Before using Netstat, it helps to understand two key concepts.

Port

A port is a communication endpoint used by applications.

Common examples:

• Port 80 = HTTP
• Port 443 = HTTPS
• Port 21 = FTP
• Port 25 = SMTP
• Port 3389 = Remote Desktop

PID (Process ID)

A PID is a unique number assigned to every running process in Windows.

Using PID, you can match a network connection to:

• Applications
• Windows services
• Background processes

How To Open Command Prompt In Windows 11

To use Netstat, you need Command Prompt.

Method 1: Run As Administrator

1. Press Windows + S
2. Type Command Prompt
3. Right-click it
4. Select Run as administrator

Method 2: Using Power User Menu

1. Press Windows + X
2. Choose Windows Terminal (Admin) or Command Prompt (Admin)

Administrator mode is recommended because some network information may be hidden without elevated permissions.

Basic Netstat Command

The simplest command is:

netstat

This displays:

• Active TCP connections
• Foreign addresses
• Connection states

However, it does not show PID or all listening ports.

How To See Listening Ports And PID In Windows 11

The most useful command is:

netstat -ano

What Each Parameter Means:

• -a = Shows all connections and listening ports
• -n = Displays numerical addresses instead of resolving hostnames
• -o = Shows the owning PID

Example Output:

Proto  Local Address          Foreign Address        State           PID
TCP    0.0.0.0:135            0.0.0.0:0              LISTENING       992
TCP    0.0.0.0:445            0.0.0.0:0              LISTENING       4
TCP    192.168.1.5:49732      142.250.183.14:443     ESTABLISHED     10520

How To Interpret The Results

Proto

Shows the protocol:

• TCP
• UDP

Local Address

Your computer’s IP address and port number.

Foreign Address

Remote IP address or external connection.

State

Common states include:

• LISTENING
• ESTABLISHED
• TIME_WAIT
• CLOSE_WAIT

PID

The process responsible.

Focus Only On Listening Ports

To filter listening ports:

netstat -ano | findstr LISTENING

This command shows only ports currently waiting for incoming connections.

Example:

TCP    0.0.0.0:80      0.0.0.0:0      LISTENING      4120

This means:

• Port 80 is open
• Service is listening
• PID is 4120

Find Which Application Uses A PID

After identifying a PID, use Tasklist:

tasklist | findstr 4120

Example Output:

httpd.exe                 4120 Console     1     12,000 K

This tells you Apache is using port 80.

Alternative: Use Task Manager

You can also:

1. Press Ctrl + Shift + Esc
2. Open Task Manager
3. Go to Details
4. Find matching PID

If PID column is hidden:

• Right-click column headers
• Enable PID

Check Specific Port Usage

To see if a specific port is open:

netstat -ano | findstr :443

This checks HTTPS traffic.

Other examples:

netstat -ano | findstr :3389
netstat -ano | findstr :80
netstat -ano | findstr :21

Display Executable Names Directly

You can use:

netstat -ab

Meaning:

• -a = All connections
• -b = Shows executable

Example:

[chrome.exe]
TCP    192.168.1.5:50000   172.217.0.0:443   ESTABLISHED

Important:

• Requires administrator privileges
• Can take longer
• May show “Access denied” for protected processes

Save Netstat Output To A File

For troubleshooting or analysis:

netstat -ano > C:\netstat_results.txt

This creates a text file for review.

Refresh Netstat Continuously

To monitor changes every 5 seconds:

netstat -ano 5

This continuously updates connection data.

Common Listening Ports In Windows 11

You may commonly see:

• 135 = RPC
• 445 = SMB
• 3389 = Remote Desktop
• 80 = Web server
• 443 = Secure web services
• 53 = DNS

Not all open ports are dangerous, but unfamiliar services should be investigated.

How To Close Suspicious Processes

If you identify a suspicious PID:

taskkill /PID 4120 /F

Warning:

Only terminate processes you understand. Closing essential services can affect Windows stability.

Security Best Practices

When reviewing listening ports:

Investigate Unknown Ports

Search unfamiliar services.

Disable Unneeded Services

Reduce exposure.

Use Windows Defender Firewall

Block unwanted traffic.

Keep Windows Updated

Patch vulnerabilities.

Run Malware Scans

If suspicious activity appears.

Netstat Vs Resource Monitor

Netstat:

• Command line
• Detailed
• Fast
• Powerful

Resource Monitor:

• Graphical interface
• Easier for beginners
• Less technical

To open Resource Monitor:

resmon

Then go to Network tab.

Troubleshooting Common Problems

“Access Denied”

Run Command Prompt as administrator.

Too Much Information

Use filters:

findstr LISTENING
findstr :80

Unknown PID

Use:

tasklist /svc

This shows related services.

Advanced Netstat Commands

Routing Table:

netstat -r

Ethernet Statistics:

netstat -e

Protocol Statistics:

netstat -s

Display All:

netstat -anob

When To Use Netstat

Netstat is particularly helpful when:

• Internet is slow
• A port conflict occurs
• Malware is suspected
• Hosting services fail
• Firewall rules need checking
• Remote access issues arise

Advantages Of Netstat

Built Into Windows

No installation required.

Lightweight

Minimal resource use.

Detailed

Provides exact process mapping.

Fast

Instant results.

Flexible

Supports filtering and logging.

Limitations Of Netstat

Command Line Complexity

May seem intimidating for beginners.

Requires Admin Rights

For full visibility.

Static Snapshots

Unless monitored continuously.

Can Be Verbose

Large output without filters.

Final Thoughts

Netstat remains one of the most powerful built-in networking tools in Windows 11 for checking listening ports and associated process IDs. Whether you are diagnosing connectivity problems, verifying server applications, identifying suspicious connections, or monitoring your PC’s network activity, Netstat provides deep visibility into your system.

Using commands like:

netstat -ano

and:

tasklist | findstr PID

gives you precise control over network diagnostics without needing third-party software.

For everyday users, this tool can improve troubleshooting and security awareness. For advanced users and administrators, it remains essential for system management.

By learning how to read ports, PIDs, and connection states, you gain a stronger understanding of how Windows 11 communicates across networks and how to keep your system secure.