Get-NetTCPConnection
List active TCP connections (PowerShell netstat).
Windowspassive
Get-NetTCPConnection shows TCP connections and listeners with owning process IDs — the modern netstat for Windows.
Syntax
Get-NetTCPConnection [-State {state}]
Example
Get-NetTCPConnection -State Listen | Select LocalAddress,LocalPort,OwningProcess
Lists listening ports and the PID that owns each — handy for spotting backdoors.
Options & flags
What each switch does. Toggle them in the builder below to assemble a command.
Command builder
Tick options (and fill any values) to build a ready-to-copy command.
get-nettcpconnection
Usage examples
Get-NetTCPConnection -State Listen | Select LocalPort,OwningProcess
List listening ports + PIDs.
Get-NetTCPConnection -State Established
Show active connections.
Advantages
- Maps ports to owning process
- Filterable objects
- No external tools
Disadvantages
- Windows-only
- No per-connection bandwidth
- Verbose without Select
Tags
#windows#network#netstat
Official docs: Get-NetTCPConnection ↗
Related commands
Frequently asked questions
What is Get-NetTCPConnection used for?
Get-NetTCPConnection shows TCP connections and listeners with owning process IDs — the modern netstat for Windows.
What is an example Get-NetTCPConnection command?
A common example is: Get-NetTCPConnection -State Listen | Select LocalAddress,LocalPort,OwningProcess — Lists listening ports and the PID that owns each — handy for spotting backdoors.
Is Get-NetTCPConnection part of a standard install?
Get-NetTCPConnection runs on Windows. It is typically available by default.
What category of security tool is Get-NetTCPConnection?
Get-NetTCPConnection is a PowerShell tool with a passive-risk profile when run against a live target.
Try recon tools live
Run real scans against a domain you control, stage by stage.