How to Find Network Connections of a Process

When troubleshooting network issues, debugging applications, or performing security analysis, you may need to find which network connections a process is using. Fortunately, most operating systems provide built-in tools to inspect this information without installing third-party software.

This guide covers both Linux and Windows methods using common system utilities.

On Linux

1. Using netstat

# Show all connections with associated process IDs
netstat -tulnp

Options explained:

  • -t → TCP connections
  • -u → UDP connections
  • -l → Listening sockets
  • -n → Show numeric addresses/ports (faster, no DNS lookup)
  • -p → Show process ID and program name

Example output:

tcp   0   0 0.0.0.0:80   0.0.0.0:*   LISTEN   1234/nginx

2. Using lsof

# Replace <PID> with the process ID
lsof -i -a -p <PID>
 
# Show all processes using port 443
lsof -i :443

Example output:

nginx  1234  user   6u  IPv4  56789  0t0  TCP *:https (LISTEN)

3. Inspecting /proc + ss

# List file descriptors
ls -l /proc/<PID>/fd
 
# Check network connections
ss -tp

The -p flag shows which process owns each socket.

On Windows

1. Using netstat

netstat -ano

Options explained:

  • -a → All connections and listening ports
  • -n → Numeric addresses
  • -o → Show process ID (PID)

Example output:

TCP    0.0.0.0:80     0.0.0.0:0     LISTENING     1234

Here, process 1234 is listening on port 80.

To find which program corresponds to that PID:

tasklist /FI "PID eq 1234"

2. Using PowerShell

You can use the built-in Get-NetTCPConnection cmdlet:

# Show all TCP connections with process IDs
Get-NetTCPConnection | Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, State, OwningProcess

To find which application owns a connection:

# Example: connections of process ID 1234
Get-Process -Id 1234

Or filter by program name:

# Example: all connections owned by chrome.exe
Get-NetTCPConnection | Where-Object { (Get-Process -Id $_.OwningProcess).ProcessName -eq "chrome" }

Practical Examples

Linux (nginx):

pidof nginx
lsof -i -a -p $(pidof nginx)
ss -tp | grep nginx

Windows (IIS / w3wp.exe):

# Find which process is listening on port 80
netstat -ano | findstr :80
 
# Map PID to program
tasklist /FI "PID eq <PID>"

Conclusion

Finding network connections of a process doesn't require special tools—just built-in utilities:

  • Linux: netstat, lsof, ss, /proc
  • Windows: netstat -ano, tasklist, Get-NetTCPConnection

These techniques are essential for system administrators, developers, and security analysts to debug, monitor, and secure their systems.

Related Cybersecurity Guides and Tutorials: