How to Obtain Ports That a Process in Listening On

How do I find out which process is listening on a TCP or UDP port on Windows?

PowerShell

TCP

Get-Process -Id (Get-NetTCPConnection -LocalPort YourPortNumberHere).OwningProcess

UDP

Get-Process -Id (Get-NetUDPEndpoint -LocalPort YourPortNumberHere).OwningProcess

cmd

 netstat -a -b

(Add -n to stop it trying to resolve hostnames, which will make it a lot faster.)

Note Dane's recommendation for TCPView. It looks very useful!

-a Displays all connections and listening ports.

-b Displays the executable involved in creating each connection or listening port. In some cases well-known executables host multiple independent components, and in these cases the sequence of components involved in creating the connection or listening port is displayed. In this case the executable name is in [] at the bottom, on top is the component it called, and so forth until TCP/IP was reached. Note that this option can be time-consuming and will fail unless you have sufficient permissions.

-n Displays addresses and port numbers in numerical form.

-o Displays the owning process ID associated with each connection.

How to get port a process is listening on in .net?

Unfortunately, IPGlobalProperties.GetIPGlobalProperties() does not return any information on which process is holding the socket, as it uses GetTcpTable not GetTcpTable2.

You would need to code it yourself. The below code works for TCP over IPv4. You would need similar code for UDP and IPv6.

[DllImport("Iphlpapi.dll", ExactSpelling = true)]
static extern int GetTcpTable2(
  IntPtr TcpTable,
  ref int SizePointer,
  bool Order
);

[StructLayout(LayoutKind.Sequential)]
struct MIB_TCPTABLE
{
    public int dwNumEntries;
}

[StructLayout(LayoutKind.Sequential)]
struct MIB_TCPROW2
{
    public MIB_TCP_STATE dwState;
    public int dwLocalAddr;
    public byte localPort1;
    public byte localPort2;
    // Ports are only 16 bit values (in network WORD order, 3,4,1,2).
    // There are reports where the high order bytes have garbage in them.
    public byte ignoreLocalPort3;
    public byte ignoreLocalPort4;
    public int dwRemoteAddr;
    public byte remotePort1;
    public byte remotePort2;
    // Ports are only 16 bit values (in network WORD order, 3,4,1,2).
    // There are reports where the high order bytes have garbage in them.
    public byte ignoreremotePort3;
    public byte ignoreremotePort4;
    public int dwOwningPid;
    public TCP_CONNECTION_OFFLOAD_STATE dwOffloadState;
}

public enum MIB_TCP_STATE
{
    Closed = 1,
    Listen,
    SynSent,
    SynRcvd,
    Established,
    FinWait1,
    FinWait2,
    CloseWait,
    Closing,
    LastAck,
    TimeWait,
    DeleteTcb
}

enum TCP_CONNECTION_OFFLOAD_STATE
{
    TcpConnectionOffloadStateInHost,
    TcpConnectionOffloadStateOffloading,
    TcpConnectionOffloadStateOffloaded,
    TcpConnectionOffloadStateUploading,
    TcpConnectionOffloadStateMax
}

static List<IPEndPoint> GetSocketsForProcess(int pid, MIB_TCP_STATE state = MIB_TCP_STATE.Established)
{
    const int ERROR_INSUFFICIENT_BUFFER = 0x7A;

    var size = 0;
    var result = GetTcpTable2(IntPtr.Zero, ref size, false);
    if (result != ERROR_INSUFFICIENT_BUFFER)
        throw new Win32Exception(result);
        
    var ptr = IntPtr.Zero;
    try
    {
        ptr = Marshal.AllocHGlobal(size);
        result = GetTcpTable2(ptr, ref size, false);
        if (result != 0)
            throw new Win32Exception(result);

        var list = new List<IPEndPoint>();
        var count = Marshal.ReadInt32(ptr);
        var curPtr = ptr + Marshal.SizeOf<MIB_TCPTABLE>();
        var length = Marshal.SizeOf<MIB_TCPROW2>();
        for(var i = 0; i < count; i++)
        {
            var row = Marshal.PtrToStructure<MIB_TCPROW2>(curPtr);
            if(row.dwOwningPid == pid && row.dwState == state)
                list.Add(new IPEndPoint(row.dwLocalAddr, row.localPort1 << 8 | row.localPort2));
            curPtr += length;
        }
        return list;
    }
    finally
    {
        Marshal.FreeHGlobal(ptr);
    }
}

Process listening which Port on Windows

On windows 7, you can use

netstat -b -a

netstat /?

-b      Displays the executable involved in creating each connection or
          listening port. In some cases well-known executables host
          multiple independent components, and in these cases the
          sequence of components involved in creating the connection
          or listening port is displayed. In this case the executable
          name is in [] at the bottom, on top is the component it called,
          and so forth until TCP/IP was reached. Note that this option
          can be time-consuming and will fail unless you have sufficient
          permissions.
-o      Displays the owning process ID associated with each connection.

On Linux use, -p needs root privileges.

#netstat -p

#netstat -h
-p, --programs           display PID/Program name for sockets

Find the PID of a process that uses a port on Windows

Just open a command shell and type (saying your port is 123456):

netstat -a -n -o | find "123456"

You will see everything you need.

The headers are:

 Proto  Local Address          Foreign Address        State           PID
 TCP    0.0.0.0:37             0.0.0.0:0              LISTENING       1111

Find process owning a port programmatically

GetExtendedTcpTable is the function you need to call, with one of the flags that indicates you want the owning process id (TCP_TABLE_OWNER_PID_*). This will cause it to return a MIB_TCPTABLE_OWNER_PID structure, which contains an array of MIB_TCPROW_OWNER_PID. There is a flag to specify if you want IPv4 or IPv6. For Udp, there is GetExtendedUdpTable with similar behavior.

---

Related Topics