TCPView
Copyright 1997-2021 Mark Russinovich and Bryce Cogswell
Sysinternals - www.sysinternals.com

Introduction

TCPView is a Windows program that will show you detailed listings of all TCP and UDP endpoints on your system, including the owning process name, remote address and state of TCP connections. TCPView provides a conveniently presented subset of the Netstat program that ships with Windows.

TCPView requires Windows Vista or higher.

Using TCPView

When you start TCPView it will enumerate all active TCP and UDP endpoints, resolving all IP addresses to their domain name versions. You can use a toolbar button or menu item to toggle the display of resolved names. If you run with administrative rights (the default if user is an admin), TCPView will also show the amount of TCP and UDP traffic flowing through an endpoint.

By default, TCPView updates every second, but you can use the View | Update Speed menu item to change the rate. Press SPACE to quickly toggle between pausing and resuming updates. Endpoints that change state from one update to the next are highlighted in yellow; those that are deleted are shown in red, and new endpoints are shown in green.

You can close established TCP/IP connections (those labeled with a state of Established) by selecting Connection | Close Connection, or by right-clicking on a connection and choosing Close Connection from the resulting context menu.

If you want to see who owns the domain registered for a remote address, select the item containing the name and choose Whois from the context menu or the Connection menu.

You can save TCPView's output window to a file using the Save menu item.

New for version 4.0

Version 4.0 adds a creation time column, as well as a module name. The module name shows the executable's name in many cases, but for a process that hosts services, it shows the service name responsible for the endpoint.

Quick search for a process name, module name, or domain name is available in the toolbar area. Further filtering is available with the four toolbar button for protocols of interest.