Tip 119: How to determine which ports a specific process is using on Windows XP and later

Sometimes you want or need to find out which ports a process is using. To be able to do that you can use the process name to determine the process identifier (PID).
For example, to identify the PID for the pop3svc.exe process running on a system, go to the command prompt and type:

c:\> tasklist /fi "IMAGENAME eq pop3svc.exe"

In this example the command returned the following information:
Image Name PID Session Name Session# Mem Usage
POP3Svc.exe 2554 RDP-Tcp#9 0 2,072 K

The second column shows the PID, which you can then use with the Netstat command to search all in-use ports.

Note: If you prefer to search for this information in a graphical form you could use Task Manager and add an extra column to be displayed in the Process page via menu: View, Select columns and then tick the checkbox PID (Process Identifier).
Alternatively you could also download a very comprehensive freeware Process Explorer at www.sysinternals.com

Having found the process ID, you can now type:

c:\> netstat -ano | findstr 2554

and the system returns the following information:

TCP 0.0.0.0:110 0.0.0.0:0 LISTENING 2554

In this example the result shows that the POP3 service is using TCP port 110 on all addresses.

You can also perform a reverse operation to find out which process is associated with a port.
For example, to identify which process is using port 25, you could go to the command prompt and type:

c:\> netstat -ano | findstr :25

Now the system could return the following information:

TCP 0.0.0.0:25 0.0.0.0:0 LISTENING 2733

After you identify the process (in this case, 2733), you can determine the process name by typing:

c:\> tasklist /fi "PID eq 2733"

which, in this example, returns the following information:

Image Name PID Session Name Session# Mem Usage
inetinfo.exe 2733 RDP-Tcp#9 0 5,584 K

This information tells you that port 25 is being used by the inetinfo.exe process.

Last Modified: 10/03/2022 20:42:39