Command library / Get-NetTCPConnection

List TCP connections and listening ports

PowerShell's netstat, returning objects you can filter. Each connection has a LocalAddress and LocalPort, a RemoteAddress and RemotePort, a State (Listen, Established, TimeWait…) and an OwningProcess: the PID of the program behind it, which you can hand straight to Get-Process.

Usage

Options and flags

• -State STATE

  only connections in this state, e.g. Listen or Established

• -LocalPort PORT

  only connections on this local port

• -RemotePort PORT

  only connections to this remote port

• -RemoteAddress IP

  only connections to this remote address

• -OwningProcess PID

  only connections owned by this process ID

Examples

• Get-NetTCPConnection -State Listen

  Every TCP port this host is listening on.

• Get-NetTCPConnection -LocalPort 3389

  Anything using local port 3389 (Remote Desktop).

• Get-NetTCPConnection -OwningProcess 4444

  Every connection belonging to process 4444.

• Get-NetTCPConnection -State Established -RemotePort 443

  Open HTTPS connections from this host.

Common mistakes

Related commands