Many Windows administrators and security teams need to verify which services are listening on network interfaces. Quickly checking open ports helps troubleshoot application connectivity and reduces exposure from unnecessary services.
This guide explains how to list, filter, and monitor open ports on Windows using built-in tools and best practices. You will learn commands, configurations, and interpretations tailored for common workflows and compliance requirements.
| Tool | Command Syntax | Typical Use Case | Output Highlights |
|---|---|---|---|
| netstat | netstat -ano | Quick overview of listening sockets and owning processes | Protocol, Local Address, Foreign Address, State, PID |
| Get-NetTCPConnection | Get-NetTCPConnection -State Listen | Piping to Format-Table for clear reports | LocalPort, RemoteAddress, State, OwningProcess |
| Resource Monitor | resmon | GUI-based inspection with network tab | Listening ports, associated services, TCP connections |
| Windows Firewall with Advanced Security | wf.msc | Reviewing rules that allow inbound traffic | Enabled rules, local ports, protocol, action |
Diagnosing Listening Ports with Command Line Tools
The command prompt offers several ways to enumerate active ports without installing third-party software. Administrators often rely on netstat combined with tasklist to correlate process IDs with services.
PowerShell provides object-oriented cmdlets such as Get-NetTCPConnection, which return structured data that is easier to filter and export. These cmdlets support selecting specific protocols, states, and port ranges for focused analysis.
Filtering Results to Specific Protocols and Ports
Narrowing the scope helps when you only need to review, for example, TCP ports used by web services. You can filter by protocol, local address, or port number to reduce noise in the output.
When dealing with UDP, remember that connectionless traffic does not always appear in the same state columns as TCP. Explicitly requesting UDP entries ensures you see DNS, SNMP, or custom services that rely on UDP listeners.
Correlating Ports to Processes and Services
A port number alone rarely explains the business purpose of a listening service. Linking a port to its owning process ID and then to the executable helps security teams validate whether it is expected.
Service names and display names in the Services snap-in provide additional context. Administrators can stop, disable, or reconfigure services that expose unnecessary ports, reducing the attack surface.
Configuring Firewall Rules to Control Access
Windows Firewall rules determine which applications and ports can receive network traffic. Outbound rules can also restrict unwanted external connections initiated by applications.
When tightening policies, consider protocol, local port, remote address, and scope. Logging enabled rules helps identify allowed traffic patterns and potential misconfigurations before incidents occur.
Securing and Maintaining Port Hygiene
- Regularly review listening ports using netstat and Get-NetTCPConnection to detect unexpected services.
- Correlate each open port with a documented application purpose and ownership team.
- Apply least privilege to services and restrict allowed source addresses in firewall rules.
- Schedule periodic scans and logging to identify changes and unauthorized listeners.
- Document exceptions and justify every rule that allows inbound traffic to critical ports.
FAQ
Reader questions
How can I list only TCP ports that are currently listening without showing established connections?
Run netstat -ano | findstr LISTENING or, in PowerShell, use Get-NetTCPConnection -State Listen to show TCP endpoints that are actively waiting for connections.
What is the command to show which process is using a specific port number?
Use netstat -ano | findstr : and then match the PID in the last column with tasklist to identify the owning executable.
How do I check for open UDP listeners on Windows
In PowerShell, run Get-NetUDPEndpoint to list bound UDP endpoints and cross-reference the associated process name to verify legitimacy.
Can Windows Firewall block a port that is already open
Yes, you can create an inbound rule with action Block for a specific local port to prevent external access even when a service is listening.