How to Check Specific Port Status in Windows Command Line: Faster Alternative to Netstat

Table of Contents#

1. Why Netstat Might Not Be Ideal Anymore
2. Faster Alternatives: netsh and PowerShell
   • 2.1 Using netsh (Command Prompt)
   • 2.2 Using PowerShell’s Get-NetTCPConnection
3. Step-by-Step Guides
   • 3.1 Checking Ports with netsh
   • 3.2 Checking Ports with PowerShell
4. Comparing Tools: Netstat vs. netsh vs. PowerShell
5. Advanced Tips & Tricks
6. Conclusion
7. References

Why Netstat Might Not Be Ideal Anymore#

netstat has been a staple for decades, but it has significant drawbacks:

• Slow Performance: By default, netstat resolves IP addresses to hostnames and port numbers to service names (e.g., port 80 → "http"), which adds latency. Even with the -n flag (no DNS resolution), it’s slower than modern alternatives.
• Microsoft's Recommendation: Although netstat is still supported, Microsoft recommends using more modern tools like PowerShell cmdlets such as Get-NetTCPConnection (source: Microsoft Docs).
• Limited Filtering: netstat requires external tools like findstr to filter results, making it cumbersome for complex queries (e.g., "show all established connections on port 443").

Faster Alternatives: netsh and PowerShell#

Let’s explore two faster, more powerful tools to check port status: netsh (for Command Prompt) and PowerShell’s Get-NetTCPConnection.

2.1 Using netsh (Command Prompt)#

netsh (network shell) is a built-in Windows utility for configuring and monitoring network settings. It’s lightweight, fast, and works directly in Command Prompt.

Key Features:#

• Fast Execution: No unnecessary DNS lookups by default.
• Built-in Filtering: Use findstr (Command Prompt’s search tool) to filter results by port, protocol, or state.
• Supports TCP/UDP: Check both TCP and UDP ports.

Basic Syntax for netsh:#

To check TCP ports:

netsh int tcp show connections  # Show all active TCP connections  
netsh int tcp show listeners    # Show all listening TCP ports (services waiting for connections)  

To check UDP ports (less common, as UDP is connectionless):

netsh int udp show connections  # Show all active UDP endpoints  

Filtering with findstr:#

Use findstr to isolate results for a specific port (e.g., port 8080):

# Check TCP connections on port 8080 (listening or established)  
netsh int tcp show connections | findstr /i ":8080"  
 
# Check listening TCP ports on port 443 (HTTPS)  
netsh int tcp show listeners | findstr /i ":443"  

Flags for findstr:

• /i: Case-insensitive search.
• /r: Use regular expressions (e.g., findstr /r ":80\|443" to match ports 80 or 443).

2.2 Using PowerShell’s Get-NetTCPConnection#

PowerShell’s Get-NetTCPConnection is a modern, object-oriented cmdlet designed for network diagnostics. It’s faster than netstat and netsh and offers granular filtering without external tools.

Key Features:#

• Native Filtering: Filter by port, state, remote address, or process ID (PID).
• Structured Output: Results are returned as objects, making it easy to export to CSV, sort, or pipe to other commands.
• Supports Advanced Queries: Combine with Where-Object for complex logic (e.g., "show all established connections from remote IP 192.168.1.100").

Basic Syntax:#

# Check all TCP connections on local port 8080  
Get-NetTCPConnection -LocalPort 8080  
 
# Shorthand alias: `gnpc` (Get-NetTCPConnection)  
gnpc -LocalPort 8080  

Sample Output:#

LocalAddress LocalPort RemoteAddress RemotePort State       AppliedSetting OwningProcess  
------------ --------- ------------- ---------- -----       -------------- -------------  
0.0.0.0      8080      0.0.0.0        0          Listen                     1234  
192.168.1.5  8080      203.0.113.10   54321      Established                1234  

Key Columns:

• LocalPort: The port on your machine.
• State: Connection status (e.g., Listen = waiting for connections; Established = active connection; TIME_WAIT = closing).
• OwningProcess: PID of the application using the port (critical for troubleshooting!).

Advanced Filtering:#

Use Where-Object to refine results:

# Show all listening ports on port 80 (HTTP)  
Get-NetTCPConnection -LocalPort 80 | Where-Object State -eq 'Listen'  
 
# Show established connections on port 443 (HTTPS) from remote port 50000+  
Get-NetTCPConnection -LocalPort 443 | Where-Object { $_.State -eq 'Established' -and $_.RemotePort -ge 50000 }  
 
# Find the process using port 8080 (replace 1234 with the OwningProcess from earlier output)  
Get-Process -Id 1234  

Step-by-Step Guides#

3.1 Checking Ports with netsh#

Step 1: Open Command Prompt
Press Win + R, type cmd, and hit Enter.

Step 2: List All Listening TCP Ports
Run:

netsh int tcp show listeners  

This shows services actively listening for connections (e.g., a web server on port 80).

Step 3: Check a Specific Port (e.g., 3389 for Remote Desktop)
Filter for port 3389:

netsh int tcp show listeners | findstr /i ":3389"  

If the port is listening, you’ll see output like:

Local Address:port    : 0.0.0.0:3389  

Step 4: Check Active Connections on a Port
To see if anyone is connected to port 3389:

netsh int tcp show connections | findstr /i ":3389"  

Sample output for an established connection:

TCP    192.168.1.5:3389    10.0.0.2:56789    Established  

3.2 Checking Ports with PowerShell#

Step 1: Open PowerShell
Press Win + R, type powershell, and hit Enter.

Step 2: Basic Port Check (e.g., port 80)
Run:

Get-NetTCPConnection -LocalPort 80  

If a web server is running, you’ll see:

LocalAddress LocalPort RemoteAddress RemotePort State  OwningProcess  
------------ --------- ------------- ---------- -----  -------------  
0.0.0.0      80        0.0.0.0        0          Listen 456 (nginx.exe)  

Step 3: Filter by Connection State
To find only established connections on port 443 (HTTPS):

Get-NetTCPConnection -LocalPort 443 | Where-Object State -eq 'Established'  

Step 4: Export Results to CSV (for reporting)

Get-NetTCPConnection -LocalPort 8080 | Export-Csv -Path "C:\Port8080_Report.csv" -NoTypeInformation  

Comparing Tools: Netstat vs. netsh vs. PowerShell#

Winner: PowerShell’s Get-NetTCPConnection is the best choice for speed, flexibility, and modern workflows. Use netsh only if you need a quick Command Prompt-based check.

Advanced Tips & Tricks#

1. Check a Remote Port (Indirectly)#

To check if a remote server’s port is open (e.g., google.com:80), use Test-NetConnection (PowerShell):

Test-NetConnection -ComputerName google.com -Port 80  

2. Close a Port by Killing Its Process#

If a port is stuck (e.g., "TIME_WAIT"), use Get-NetTCPConnection to find the PID, then kill the process:

# Step 1: Find the PID using the port  
$pid = (Get-NetTCPConnection -LocalPort 8080).OwningProcess  
 
# Step 2: Kill the process (replace 1234 with $pid)  
Stop-Process -Id 1234 -Force  

3. Schedule Regular Port Checks#

Use Windows Task Scheduler to run a PowerShell script that logs port statuses (e.g., check port 443 every hour):

# Save as "PortCheck.ps1"  
Get-NetTCPConnection -LocalPort 443 | Select-Object LocalPort, State, OwningProcess, @{n='Time';e={Get-Date}} | Export-Csv -Path "C:\PortLogs\443_Log.csv" -Append -NoTypeInformation  

Conclusion#

netstat is no longer the best tool for checking port status in Windows. For speed and simplicity, use netsh in Command Prompt. For advanced filtering, process identification, or automation, PowerShell’s Get-NetTCPConnection is superior. By adopting these modern tools, you’ll diagnose network issues faster and work more efficiently.

References#

• Microsoft Docs: netsh Command
• Microsoft Docs: Get-NetTCPConnection
• Microsoft Docs: Deprecation Notice for netstat