(Because TCP is a connection-oriented protocol, TCP communication requires both sides of a data exchange to establish a connection for the duration of the exchange.) When you run Netstat without any command-line arguments, it prints a list of TCP endpoints that are in a connected state, along with each connection's locally bound IP address and the IP address of the connection's remote side. You can download TCPView and its command-line equivalent, TCPVCon, at. Sysinternals' TCPView-a free GUI application that runs on Windows NT 4.0 and later-displays a superset of the information that Netstat shows and gives you an easy way to monitor changes to port use over time. Furthermore, Netstat doesn't provide a convenient way to see changes in TCP/IP port use. These limitations make it difficult to determine which process owns an open network port.

The version that comes with Windows 2000 and earlier doesn't report the process associated with an endpoint the version that comes with Windows Server 2003 and Windows XP shows the owning process's process identifier (PID) but not the process's image name. You can use Windows' built-in Netstat tool to obtain such information, but Netstat has several limitations. As a Windows administrator, you often need to monitor active TCP/IP ports to determine which network application server ports are active, ensure that ports aren't open unexpectedly, and find out which remote systems a computer is accessing.

Tcpview windows