How to inspect network connections

Overview

netstat reports network connections and listening endpoints. It is read-only and useful for troubleshooting an app or local service.

Local addresses belong to your computer; foreign addresses are remote endpoints. LISTENING means a local service awaits connections, not necessarily that it is exposed to the internet.

• Use the PID from -o with TASKLIST to identify a process.
• Addresses 0.0.0.0 and :: mean all local interfaces for that IP version.
• Connection lists change continually as apps open and close sessions.

Commands to try

Type each command at the prompt, then press Enter. Replace sample names and paths with ones that exist on your computer.

Commands are generally not case-sensitive, but preserving the spelling shown here makes scripts easier to read.

netstat
netstat -ano
netstat -ano | findstr LISTENING
netstat -ano | findstr ":443"
tasklist /fi "pid eq 1234"

Useful options and details

Options change how a command behaves. Add spaces exactly as shown, and use the command's built-in help when an option is unfamiliar.

A path containing spaces must be enclosed in double quotes, such as "C:\My Files".

• -a includes all connections and listening ports.
• -n keeps addresses and ports numeric for faster, clearer output.
• -o adds the owning PID; -b may require elevation and is slower.

Tips and common mistakes

Check the current folder and read the command output before assuming an operation succeeded.

Practice with disposable files first. Commands that delete, overwrite, or stop a process may not offer an Undo button.

• An unfamiliar connection is not proof of malware; browsers and Windows services contact many hosts.
• Do not end a process based solely on a port number.
• Publicly shared output may reveal local addresses and active services.

Safe practice

Create a temporary practice folder under your user profile so the examples cannot affect Windows system files.

After each command, inspect the result with dir or another read-only command before continuing.

• Capture netstat -ano before and after opening a website.
• Filter for LISTENING entries.
• Identify one noncritical PID with TASKLIST without stopping it.