Netstat explainer
Paste what netstat or PowerShell prints, and see which programs are talking to the internet, what each open port is for, and what deserves a closer look. What you paste is read in your browser and is not uploaded.
1. Copy your connections
Easiest: open PowerShell (no administrator needed), paste this, and press Enter. It names the program behind every connection and copies the result to your clipboard.
$p=@{}; Get-Process | ForEach-Object { $p[$_.Id]=$_.ProcessName }; @(Get-NetTCPConnection | Where-Object State -ne 'Bound' | Select-Object @{n='Proto';e={'TCP'}},LocalAddress,LocalPort,RemoteAddress,RemotePort,State,OwningProcess) + @(Get-NetUDPEndpoint | Select-Object @{n='Proto';e={'UDP'}},LocalAddress,LocalPort,@{n='RemoteAddress';e={''}},@{n='RemotePort';e={''}},@{n='State';e={''}},OwningProcess) | Select-Object *,@{n='Process';e={$p[[int]$_.OwningProcess]}} | ConvertTo-Csv -NoTypeInformation | Set-ClipboardOr classic netstat in Command Prompt: netstat -ano (process numbers only), or netstat -anob in a Command Prompt run as administrator, which adds program names.
2. Paste it here
Nothing you paste leaves this page unless you press "Check against threat lists" below, which sends only the internet addresses.
Worth a look
Programs talking to other computers
Open on your PC
Ports a program is listening on. All interfaces means other devices can try to connect, if Windows Firewall lets them. This PC only means nothing outside your PC can reach it.
How to read netstat
- Proto
- TCP for connections, UDP for one-off messages such as DNS lookups and device discovery.
- Local Address
- Your side: an address on your PC and a port.
0.0.0.0or[::]means every network adapter,127.0.0.1means this PC only. - Foreign Address
- The other side.
0.0.0.0:0or*:*means there is no other side yet: something is waiting for connections. - State
- LISTENING waits for connections. ESTABLISHED is an open connection. TIME_WAIT and CLOSE_WAIT are connections that are closing. SYN_SENT is still trying to connect, and many of them can mean something is scanning or a server is unreachable.
- PID
- The process ID of the program that owns the connection. Match it in Task Manager on the Details tab, or with
tasklist /fi "PID eq 1234". PID 4 is the Windows kernel (System).