What process is using TCP port in Windows
It often happens that the system administrator needs to quickly determine which program / process uses a specific TCP port on a Windows server. Many use third-party utilities for this, for example, TCPView from Rusinovich. However, Windows Server 2008 (like earlier distributions of Windows Server OS) can give you this information using built-in commands. To determine which process uses the tcp port you need in Windows Server, you use a combination of standard netstat and tasklist
The specified command will display information about network connections at the port level:
Netstat -a -n -o
The -o parameter is used to obtain information about the process identifier (PID). The output of the command is provided below:
After you have obtained open ports and process identifiers using netstat, you can then use Windows Task Manager, first add a column with a PID there, or use the command line utility – tasklist. In the example above, ports 5800 and 5900 use a process with a PID of 1812, so write the following query using the tasklist command.
As you can see in the picture, the process that uses the specified ports is WinVNC4.