Field notesAUWENSearch
Explore Systems
← Command indexPowerShell / network

Get-NetTCPConnection

Inspect local TCP endpoints and their owning process IDs.

Syntax

UPPERCASE words are placeholders to replace. Brackets in the syntax line describe optional arguments; do not type those brackets literally.

Get-NetTCPConnection [-State STATE] [-LocalPort PORT]

Example

Get-NetTCPConnection -State Listen | Select-Object LocalAddress, LocalPort, OwningProcess
# For one PID you just observed, replace 1234:
Get-Process -Id 1234

Expected result

Listening TCP endpoints with local addresses, ports and process IDs, subject to permissions. The second command requires an actual observed PID; 1234 is a placeholder.

Notes and traps

Windows NetTCPIP module. Listen is not Established. IPv4 and IPv6 bind addresses differ; 127.0.0.1 is local loopback, not an address remote clients use to reach this host. PID ownership is a point-in-time observation and can change.

Try it

Find one loopback-only listener and explain why opening an external firewall would not make that bind address remotely reachable.

Answer and reasoning

A loopback bind receives traffic addressed within that host's loopback stack. Remote exposure needs a deliberately selected reachable bind address, route and access policy. A firewall rule alone cannot change the application's bind address.

Study the related guide →

Related commands

Related tasks may need different flags and have different semantics. Check the entry before translating a command between shells.

Official reference ↗

Updated 14 September 2026. Microsoft reference reviewed 14 September 2026; not executed on Windows.