However, when you use the -o option, you must use another tool, such as Task Manager, to map the PID to an image name. The version of Netstat that ships with Windows 2003 and XP offers the -o option, which prints the PID of the process that opened each endpoint. Therefore, UDP endpoints have no state and no concept of a statically bound remote IP address. UDP is a connectionless protocol, so UDP messages can be sent from a UDP endpoint to any remote IP address. Netstat's -a option lists all active TCP and UDP endpoints, including TCP endpoints in other states such as LISTENING (waiting for a connection) and TIME_WAIT (closed).

(Because TCP is a connection-oriented protocol, TCP communication requires both sides of a data exchange to establish a connection for the duration of the exchange.) When you run Netstat without any command-line arguments, it prints a list of TCP endpoints that are in a connected state, along with each connection's locally bound IP address and the IP address of the connection's remote side. You can download TCPView and its command-line equivalent, TCPVCon, at. Sysinternals' TCPView-a free GUI application that runs on Windows NT 4.0 and later-displays a superset of the information that Netstat shows and gives you an easy way to monitor changes to port use over time. Furthermore, Netstat doesn't provide a convenient way to see changes in TCP/IP port use. These limitations make it difficult to determine which process owns an open network port. The version that comes with Windows 2000 and earlier doesn't report the process associated with an endpoint the version that comes with Windows Server 2003 and Windows XP shows the owning process's process identifier (PID) but not the process's image name. You can use Windows' built-in Netstat tool to obtain such information, but Netstat has several limitations. As a Windows administrator, you often need to monitor active TCP/IP ports to determine which network application server ports are active, ensure that ports aren't open unexpectedly, and find out which remote systems a computer is accessing.

Tcpview commands