How to Identify the Process Which has a Specific Port Reserved

Version 2

    Purpose

     

    This document shows how to identify the process that is currently using or has a reservation on a specific port.

     

    Description

     

    There are rare times when it may be necessary to identify the process that is currently using a port or has a reservation on a port. You can do this by going through the following steps on any Windows operating system:

     

    1) Open command prompt.

    2) Run the command:

    netstat -ano

    Note: Other combinations of netstat may work as well.

    3) Locate the port number in the list, and view the corresponding PID for that port.

    PID stands for Process Identifier. You will need the PID for the next step.

    1a.jpg

         In the example you can see we're looking at port TCP 5120, which has a PID of 2172.

     

    4) Open Task Manager.

    5) Go to View > Select Columns...

    2.jpg

    6) Check the box for "PID". Click OK.

    3.jpg

    7) In the Processes list, locate the PID corresponding to what you found in step three.

    8) You can now see the process that corresponds to the port based on the PID.

    Note: If you don't see your PID at first, ensure "Show processes from all users" is checked.

    4.jpg

         In the example, you can see that PID 2172, currently using port 5120, is tied to the process STSchedEx.exe - the Shavlik Remote Scheduler.

     

    Alternately you can run a command to see the same information:

    tasklist /FI "PID eq 2172"

    Just replace 2172 with whatever PID you need to look up.

    6.jpg

    Note: Just running the command "tasklist" will display a full list of running processes, but in no particular order.

     

    If you are attempting this on Windows 8 / Server 2012 or newer Windows operating system Task Manager will look slightly different.

    -Initially, you may need to click the "More Details" button.

    -View the Details tab rather than the Processes tab.

    -PID should be listed by default. If not, you can add by doing a right click on the columns, then go to "Select Columns".

    5.jpg

         In this example you can see we're looking at port TCP 5120 again, which now has a PID of 1312.

         PID 1312 is tied to the process STSchedEx.exe - the Shavlik Remote Scheduler.

     

    Additional Information

     

    The PID will not always be the same for the same process on different machines, as you can see from the examples above.

     

    More information about the netstat and tasklist commands:

    Netstat

    Tasklist