PowerShell NetStat: Check Active Network Connections

Which process is listening on port 8080? Is something unexpected connecting outbound on port 443? The classic netstat command answers these questions but returns plain text that is painful to filter and cannot be piped. PowerShell netstat active connections using Get-NetTCPConnection returns structured objects that you can filter, sort, group, and export just like any PowerShell data. This post covers filtering by port, state, and process name, finding listening ports, and exporting a connection inventory report.

Get All TCP Connections

Get-NetTCPConnection returns all current TCP connections and listening ports as objects. The output includes local and remote addresses, ports, state, and the owning process ID:

Get-NetTCPConnection | Sort-Object State, LocalPort |
    Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, State, OwningProcess |
    Format-Table -AutoSize

LocalAddress  LocalPort RemoteAddress  RemotePort State       OwningProcess
------------  --------- -------------  ---------- -----       -------------
0.0.0.0       80        0.0.0.0        0          Listen      4
0.0.0.0       443       0.0.0.0        0          Listen      4
10.1.1.50     54231     52.96.97.100   443        Established 8204
10.1.1.50     54232     10.1.1.10      1433        Established 3312

Filter by Port Number

Use -LocalPort or -RemotePort parameters to filter directly in the cmdlet call for efficiency, or pipe through Where-Object for combined conditions:

# Find what is using port 8080
Get-NetTCPConnection -LocalPort 8080

# Find all connections to a specific remote port
Get-NetTCPConnection -RemotePort 1433 | Select-Object LocalAddress, State, OwningProcess

# Find connections to or from a specific IP
Get-NetTCPConnection | Where-Object { $_.RemoteAddress -eq "10.1.1.10" }

Filter by State (Established, Listen)

TCP connection states include Listen, Established, TimeWait, CloseWait, and others. Filter to the state you care about:

# Only established outbound connections
Get-NetTCPConnection -State Established |
    Where-Object LocalAddress -ne '0.0.0.0' |
    Sort-Object RemoteAddress |
    Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, OwningProcess

# Only listening ports (services waiting for connections)
Get-NetTCPConnection -State Listen |
    Select-Object LocalAddress, LocalPort, OwningProcess |
    Sort-Object LocalPort

Map Connection to Process Name

Get-NetTCPConnection returns the process ID in OwningProcess, not the process name. Cross-reference with Get-Process to map IDs to readable names:

Get-NetTCPConnection -State Established |
    ForEach-Object {
        $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
        [PSCustomObject]@{
            LocalPort   = $_.LocalPort
            RemoteAddr  = $_.RemoteAddress
            RemotePort  = $_.RemotePort
            State       = $_.State
            ProcessName = if ($proc) { $proc.Name } else { "PID $($_.OwningProcess)" }
            PID         = $_.OwningProcess
        }
    } | Sort-Object ProcessName | Format-Table -AutoSize

LocalPort RemoteAddr    RemotePort State       ProcessName PID
--------- ----------    ---------- -----       ----------- ---
54231     52.96.97.100  443        Established chrome      8204
54232     10.1.1.10     1433        Established sqlservr    3312

Find All Listening Ports

Generate a complete inventory of all listening TCP and UDP endpoints on the local machine:

# TCP listening ports
$tcpListening = Get-NetTCPConnection -State Listen | ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    [PSCustomObject]@{
        Protocol    = "TCP"
        Port        = $_.LocalPort
        Address     = $_.LocalAddress
        ProcessName = if ($proc) { $proc.Name } else { "Unknown" }
        PID         = $_.OwningProcess
    }
}

# UDP endpoints (different cmdlet — no State property for UDP)
$udpListening = Get-NetUDPEndpoint | ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    [PSCustomObject]@{
        Protocol    = "UDP"
        Port        = $_.LocalPort
        Address     = $_.LocalAddress
        ProcessName = if ($proc) { $proc.Name } else { "Unknown" }
        PID         = $_.OwningProcess
    }
}

($tcpListening + $udpListening) | Sort-Object Port | Format-Table -AutoSize

Export Connection Report

Export a timestamped connection snapshot to CSV for security auditing or baseline comparison:

$reportPath = "C:\Reports\connections_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv"

Get-NetTCPConnection | ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    [PSCustomObject]@{
        Timestamp   = Get-Date -Format 'yyyy-MM-dd HH:mm:ss'
        LocalAddr   = $_.LocalAddress
        LocalPort   = $_.LocalPort
        RemoteAddr  = $_.RemoteAddress
        RemotePort  = $_.RemotePort
        State       = $_.State
        ProcessName = if ($proc) { $proc.Name } else { "PID $($_.OwningProcess)" }
    }
} | Export-Csv -Path $reportPath -NoTypeInformation

Write-Host "Connection report saved: $reportPath"

Common Errors and Fixes

• ProcessId needs cross-reference with Get-Process for name. OwningProcess returns an integer PID. Processes can exit between the Get-NetTCPConnection call and the Get-Process lookup, causing a “Cannot find a process with PID” error. Always use -ErrorAction SilentlyContinue on the Get-Process call and handle the null result.
• UDP connections use Get-NetUDPEndpoint, not Get-NetTCPConnection. UDP is connectionless — there are no state transitions. Use Get-NetUDPEndpoint to list UDP listeners. The object structure is slightly different: there is no RemoteAddress or State property.

Related Cmdlets / See Also

• Powershell Check Open Ports
• Powershell Network Adapters

Wrapping Up

Get-NetTCPConnection replaces netstat with structured, filterable output. Cross-reference OwningProcess with Get-Process to get process names, use Get-NetUDPEndpoint for UDP listeners, and export connection snapshots to CSV for security baselines and incident response documentation.