How to View Open Network Ports in Windows using the netstat Command

Identifying Network Bottlenecks and Malware

If a Windows Server is failing to host a website, a system administrator’s first instinct is to check the firewall. But what if the firewall is open, and traffic is still failing? The issue might be that another rogue application (like Skype or an old Apache instance) is already bound to port 80 or 443, preventing IIS from starting.

Conversely, if a security analyst suspects a workstation is infected with malware, they need to see exactly which background applications are currently establishing outbound connections to unauthorized IP addresses on the internet.

In both scenarios, the graphical Task Manager is insufficient. You must use the classic command-line utility netstat to audit the active network sockets.

The Power of netstat -ano

Open a Command Prompt or PowerShell window as an Administrator. Running the base netstat command produces a slow, difficult-to-read list. To generate a highly actionable diagnostic report, you must append the -ano flags.

netstat -ano

Breaking Down the Flags:

• -a (All): Displays all active connections and listening ports. Without this flag, netstat will only show established outbound connections and will hide the server ports that are passively waiting for inbound traffic.
• -n (Numeric): Forces the output to display raw IP addresses and port numbers (e.g., 192.168.1.5:443) rather than attempting to perform a slow DNS lookup to resolve hostnames (e.g., server.contoso.local:https). This makes the command execute almost instantly.
• -o (Owner): This is the most critical flag. It adds a column displaying the Process ID (PID) of the exact application that owns the network connection.

Reading the Output

The command will generate a multi-column table. Let’s examine a typical row:

  Proto  Local Address          Foreign Address        State           PID
  TCP    0.0.0.0:443            0.0.0.0:0              LISTENING       4124
  TCP    192.168.1.10:49212     104.21.5.12:443        ESTABLISHED     8212

• LISTENING: The port (443) is open on the local machine (0.0.0.0 means all network interfaces), waiting for incoming traffic.
• ESTABLISHED: The local machine (port 49212) has successfully connected to an external internet server (104.21.5.12 on port 443).
• PID: The process responsible for the traffic.

Hunting Down the Culprit

The netstat command told you that PID 4124 is hogging port 443, preventing your web server from starting. But what exactly is PID 4124?

You can cross-reference the PID using the Task Manager (by adding the PID column in the Details tab), or you can stay in the command line and use the tasklist command with a filter.

tasklist | findstr 4124

This command will search the active process list for that specific number and return the exact executable name:

Skype.exe                 4124 Console                  1     45,120 K

You have now definitively proven that Skype is conflicting with your web server. You can forcefully terminate the application using the taskkill command:

taskkill /PID 4124 /F

The port is instantly freed, allowing your web server to bind successfully.