NW Doc

Usually, if you want to see all the used and listening ports on your computer, you'd use the NETSTAT command.

Note: The NETSTAT command will show you whatever ports are open or in use, but it is NOT a port scanning tool!

Open command prompt

type in "netstat -an" and it will show you the "listening" ports

Output as follows


Active Connections



Proto Local Address Foreign Address State


TCP 0.0.0.0:135 0.0.0.0:0 LISTENING


TCP 0.0.0.0:445 0.0.0.0:0 LISTENING


TCP 127.0.0.1:1025 0.0.0.0:0 LISTENING


TCP 127.0.0.1:1154 127.0.0.1:1155 ESTABLISHED


TCP 127.0.0.1:1155 127.0.0.1:1154 ESTABLISHED


TCP 127.0.0.1:1157 127.0.0.1:1158 ESTABLISHED


TCP 127.0.0.1:1158 127.0.0.1:1157 ESTABLISHED


TCP 127.0.0.1:5679 0.0.0.0:0 LISTENING


TCP 127.0.0.1:27015 0.0.0.0:0 LISTENING


TCP 192.168.0.2:139 0.0.0.0:0 LISTENING


TCP 192.168.0.2:1734 80.169.170.150:443 CLOSE_WAIT


TCP 192.168.0.2:1856 68.178.211.88:80 CLOSE_WAIT


TCP 192.168.0.2:2062 85.17.144.69:80 CLOSE_WAIT


TCP 192.168.0.2:2063 85.17.144.69:80 CLOSE_WAIT


You can redirect it to a text file by adding >c:\openports.txt to the command

you can type "netstat -o" to get a list of all the owning process ID associated with each connection

Output as follows


Active Connections



Proto Local Address Foreign Address State PID


TCP firstuser:1154 localhost:1155 ESTABLISHED 2312


TCP firstuser:1155 localhost:1154 ESTABLISHED 2312


TCP firstuser:1157 localhost:1158 ESTABLISHED 2312


TCP firstuser:1158 localhost:1157 ESTABLISHED 2312


TCP firstuser:1734 80.169.170.150:https CLOSE_WAIT 2952


TCP firstuser:1856 linhost161.prod.mesa1.secureserver.net:http CLO


SE_WAIT 1348


TCP firstuser:2062 85.17.144.69:http CLOSE_WAIT 1348


TCP firstuser:2063 85.17.144.69:http CLOSE_WAIT 1348


TCP firstuser:2073
www.oneindia.in:http
CLOSE_WAIT 1348


TCP firstuser:2079
www.oneindia.in:http
CLOSE_WAIT 1348


TCP firstuser:2810 ug-in-f189.google.com:http ESTABLISHED 1348



Using Fport


fport reports all open TCP/IP and UDP ports and maps them to the owning application. This is the same information you would see using the 'netstat -an' command, but it also maps those ports to running processes with the PID, process name and path. Fport can be used to quickly identify unknown open ports and their associated applications.

Download fport from here



Using Active Ports


Active Ports - easy to use tool for Windows NT/2000/XP that enables you to monitor all open TCP and UDP ports on the local computer. Active Ports maps ports to the owning application so you can watch which process has opened which port. It also displays a local and remote IP address for each connection and allows you to terminate the owning process. Active Ports can help you to detect trojans and other malicious programs.

Download from here