Pages

Saturday, 21 September 2019

Powershell - how to find which process owns a port



Use get-netTCPConnection with the -localport option to return details for a specific local port.

get-netTCPConnection -localport 9945

LocalAddress  LocalPort RemoteAddress  RemotePort State         AppliedSetting OwningProcess

------------  --------- -------------  ---------- -----         -------------- -------------
0.0.0.0       9945      0.0.0.0        0          Bound                        9376
192.168.76.31 9945      151.101.16.133 443        Established Internet         9376


Altertatively, use the old Netstat command. -o returns the owning process id. Use Select-String to filter on a specific port
e.g

 netstat -o | Select-String -pattern 8243
                          
  TCP    192.168.76.31:8243     52.142.84.61:https ESTABLISHED     9952



Get-process returns proceses information. -id returns details for a specific process id
e.g.

get-process -id 9952
Handles  NPM(K)    PM(K)      WS(K)     CPU(s)     Id  SI ProcessName
-------  ------    -----      -----     ------     --  -- -----------
    829      50    18744      55440       6.67   9952   2 OneDrive


No comments:

Post a Comment