netstat with process name?
Solution
Use the -b
parameter:
-b Displays the executable involved in creating each connection or
listening port. In some cases well-known executables host
multiple independent components, and in these cases the
sequence of components involved in creating the connection
or listening port is displayed. In this case the executable
name is in [] at the bottom, on top is the component it called,
and so forth until TCP/IP was reached. Note that this option
can be time-consuming and will fail unless you have sufficient
permissions.
Note The netstat -b
command will fail unless run from an elevated command prompt.
Workaround
Filter the process list and find the PID you're interested in:
tasklist | findstr /c:"PID"
Alternate solution
You can use Tcpvcon.exe
instead. No admin rights required.
Tcpvcon usage is similar to that of the built-in Windows
netstat
utility.
Usage: tcpvcon [-a] [-c] [-n] [process name or PID]
-a Show all endpoints (default is to show established TCP connections).
-c Print output as CSV.
-n Don't resolve addresses.
I think you are looking for TCPView from SysInternals.
Here is an example for windows using FOR
to parse netstat
output then DO
tasklist
with /fi
filter on pid to show process name.
The last find is to remove tasklist
headers.
FOR /F "usebackq tokens=5 delims= " %i IN (`netstat -ano ^|find "443"`) DO @tasklist /fi "pid eq %i" | find "%i"
prints records output like
tomcat8.exe.x64 4240 Services 0 931,864 K
Additional fields from netstat
can be added by adding tokens.