How to Use NETSTAT to Locate TCP Socket Connections

How to Use NETSTAT to Locate TCP Socket Connections

Overview

Locating an application that is using a TCP Socket is vital to troubleshooting a conflict. NETSTAT is a built in Windows tool. 

Requirements

  1. Local Administrator Rights
  2. Experience with Command Prompt

Using NETSTAT

  1. Open an elevated Command Prompt
  2. Run the following command: netstat -ano | find "[socketnumber]"

    2. The above example shows PID 1952 is listening on TCP socket 1024
  3. This will return the process ID (PID) of the application using the TCP socket
  4. Run the following command: tasklist | find "[pid]"

    2. The above example shows PID 1952 is PDNC.exe
  5. In conclusion, we now know TCP Socket 1024 is being used by PDNC.exe

More Information

You can visit https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/netstat for more information.