Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
On Windows, Microsoft Sysinternals TCPView is a practical way to see active network endpoints and the processes using them. For a built-in option, run netstat -ano and match its process IDs to apps in Task Manager. Neither tool proves a complete history of every connection: they show activity available to them while you check.
What these tools can—and cannot—show
An endpoint view links network activity to a process. Packet capture, by contrast, records traffic visible on a selected network interface. These answer related but different questions: an endpoint list helps identify which process has an active connection, while a packet capture can provide more detail about traffic on the interface.
No single view guarantees that it will reveal every connection your computer makes. TCPView shows active endpoints when it refreshes, so short-lived activity between updates may be missed. A packet capture only covers interfaces you can select and access; Wireshark notes that inaccessible or hidden interfaces may not appear. Treat these tools as views of observable activity, not as a complete historical ledger across every interface and system context.
Free tools Windows power users keep installed
One-click scans. No signup required.
Use TCPView to see active connections and their processes
TCPView is a Windows utility from Microsoft Sysinternals. It lists active TCP and UDP endpoints, local and remote addresses, TCP state, and the process that owns each endpoint. Its default refresh interval is one second, and colors highlight new, removed, or state-changing endpoints. Microsoft’s TCPView documentation describes its fields and behavior.
#1 Best Overall
- 14" diagonal, 1366x768 resolution, HD BrightView LED, Glossy NON-TOUCH Display
- Open TCPView on the Windows computer you want to inspect.
- Review the process name alongside the protocol, local and remote address, and connection state.
- Use the color changes to notice endpoints that appear, disappear, or change state as the list refreshes.
- If you need a record, save the displayed output for later review.
A remote address you do not recognize is not, by itself, evidence of malware. First identify the owning process and consider whether its network activity fits the app or service’s expected function.
Use netstat when you prefer a built-in command
Windows netstat can list active TCP connections and listening ports. The -o option adds the process ID (PID), and -n displays addresses numerically rather than resolving names. Microsoft documents these options in its Windows netstat reference.
Rank #2
- 256 GB SSD of storage.
- Multitasking is easy with 16GB of RAM
- Equipped with a blazing fast Core i5 2.00 GHz processor.
- Open Command Prompt. Run it as administrator if you need an elevated view.
- Enter
netstat -anoand press Enter. - Read the local and foreign addresses, state, and PID in the output. A listening port is not the same thing as an established outbound connection.
- Open Task Manager, find the PID, and match it to the application or process. Microsoft describes using the PID to identify the application in Task Manager in the netstat reference.
The command gives you a snapshot, not a continuous event log. Like any point-in-time listing, it can miss a connection that starts and ends between checks.
Capture packets with Wireshark for deeper detail
If you need to inspect traffic rather than just map active endpoints to process names, use Wireshark to capture on the relevant network interface. Select the interface and capture for only as long as needed. The Wireshark capture-options guide explains interface selection and notes that inaccessible or hidden interfaces may not be available.
Rank #3
- FULL HD IPS DISPLAY - Enjoy vibrant, crystal-clear images with 178-degree wide-viewing angles
- AMD RYZEN 3 30 PROCESSOR - Everyday performance you can count on; Multitask, stream, game casually, and edit photos smoothly with responsive power and vibrant HDR visuals
- ENJOY UP TO 14 HOURS AND 15 MINUTES OF BATTERY LIFE - HP Fast Charge restores battery from 0 to 50% in approximately 45 minutes
- AMD RADEON 610M GRAPHICS - Experience smooth entertainment; Built for streaming and multitasking, enjoy realistic visuals and efficient performance for work and play
- STORAGE AND MEMORY - 512 GB PCIe NVMe M.2 SSD offers fast speed and efficient storage; and 8 GB LPDDR5 RAM memory boosts performance with higher bandwidth
Packet captures can expose network metadata and, depending on the protocol and traffic, application data. Encryption often limits what application content can be read from a capture. A capture is also not a substitute for an endpoint-to-process view: it records packets on the chosen interface, and does not inherently answer which process owns each connection.
Choose the right view for the question
| Tool | What it shows | Process ownership | Time coverage and limits |
|---|---|---|---|
| TCPView | Active TCP and UDP endpoints, addresses, and TCP state | Shows the owning process name | Live view; refreshes every second by default, so brief activity between refreshes may be missed |
netstat -ano |
Active TCP connections and listening ports with numeric addresses | Includes PIDs; match them in Task Manager | Snapshot at the time the command runs |
| Wireshark | Packets visible on selected capture interfaces | Does not by itself provide TCPView’s process-to-endpoint list | Capture period on selected interfaces; inaccessible or hidden interfaces may not appear |
| Windows wireless network report | Wi-Fi events and adapter information | Not documented as identifying every remote endpoint and owning process | Covers Wi-Fi events from the last three days and includes hidden adapters |
Use the wireless report for recent Wi-Fi history
Windows’ wireless network report is useful when you are troubleshooting Wi-Fi events, not when you need a universal list of internet connections by process. Microsoft says the report covers the last three days and lists adapters, including hidden adapters. Its documentation does not claim that it identifies every remote endpoint or the process responsible for it. See Microsoft’s guide to analyzing the wireless network report.
Rank #4
- 14” Diagonal HD BrightView WLED-Backlit (1366 x 768), Intel Graphics,
- Intel Celeron Dual-Core Processor Up to 2.60GHz, 4GB RAM, 64GB SSD
- 3x USB Type A,1x SD Card Reader, 1x Headphone/Microphone
- 802.11a/b/g/n/ac (2x2) Wi-Fi and Bluetooth, HP Webcam with Integrated Digital Microphone
- Windows 11 OS, Dale Blue
Why some background connections are normal
Operating systems and applications may connect in the background to provide features, sync data, check for updates, or support connected experiences. Microsoft says Windows connected experiences can send and process data at Microsoft to deliver those experiences; this is one reason background activity can be expected. That fact does not establish that any particular unfamiliar connection is safe. Identify its process and investigate its context before drawing a conclusion. See Microsoft’s connected experiences information.
Quick Recap
A practical way to investigate an unfamiliar connection
- Use TCPView to find the active endpoint and the process name, or run
netstat -anoand note its PID. - For a PID from netstat, locate the matching process in Task Manager.
- Check whether the process and connection make sense for the app or Windows feature in use. Do not treat an unfamiliar address alone as proof of malicious activity.
- If endpoint details are not enough, capture traffic on the relevant interface in Wireshark, keeping in mind that interface visibility and encryption limit what you can observe.
- If the issue concerns Wi-Fi events over recent days rather than a live process-to-connection mapping, consult the Windows wireless network report.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
