How to Find Network Connections of a Process

When troubleshooting network issues, debugging applications, or performing security analysis, you may need to find which network connections a process is using. Fortunately, most operating systems provide built-in tools to inspect this information without installing third-party software.

This guide covers both Linux and Windows methods using common system utilities.

On Linux

1. Using `netstat`

# Show all connections with associated process IDs
netstat -tulnp

Options explained:

-t → TCP connections
-u → UDP connections
-l → Listening sockets
-n → Show numeric addresses/ports (faster, no DNS lookup)
-p → Show process ID and program name

Example output:

tcp   0   0 0.0.0.0:80   0.0.0.0:*   LISTEN   1234/nginx

2. Using `lsof`

# Replace <PID> with the process ID
lsof -i -a -p <PID>
 
# Show all processes using port 443
lsof -i :443

Example output:

nginx  1234  user   6u  IPv4  56789  0t0  TCP *:https (LISTEN)

3. Inspecting `/proc` + `ss`

# List file descriptors
ls -l /proc/<PID>/fd
 
# Check network connections
ss -tp

The -p flag shows which process owns each socket.

On Windows

1. Using `netstat`

netstat -ano

Options explained:

-a → All connections and listening ports
-n → Numeric addresses
-o → Show process ID (PID)

Example output:

TCP    0.0.0.0:80     0.0.0.0:0     LISTENING     1234

Here, process 1234 is listening on port 80.

To find which program corresponds to that PID:

tasklist /FI "PID eq 1234"

2. Using PowerShell

You can use the built-in Get-NetTCPConnection cmdlet:

# Show all TCP connections with process IDs
Get-NetTCPConnection | Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, State, OwningProcess

To find which application owns a connection:

# Example: connections of process ID 1234
Get-Process -Id 1234

Or filter by program name:

# Example: all connections owned by chrome.exe
Get-NetTCPConnection | Where-Object { (Get-Process -Id $_.OwningProcess).ProcessName -eq "chrome" }

Practical Examples

Linux (nginx):

pidof nginx
lsof -i -a -p $(pidof nginx)
ss -tp | grep nginx

Windows (IIS / w3wp.exe):

# Find which process is listening on port 80
netstat -ano | findstr :80
 
# Map PID to program
tasklist /FI "PID eq <PID>"

Conclusion

Finding network connections of a process doesn't require special tools—just built-in utilities:

Linux: netstat, lsof, ss, /proc
Windows: netstat -ano, tasklist, Get-NetTCPConnection

These techniques are essential for system administrators, developers, and security analysts to debug, monitor, and secure their systems.

***
Note on Content Creation: This article was developed with the assistance of generative AI like Gemini or ChatGPT. While all public AI strives for accuracy and comprehensive coverage, all content is reviewed and edited by human experts at IsoSecu to ensure factual correctness, relevance, and adherence to our editorial standards.