> ## Content Index
> Fetch the complete content index at: https://www.filipkonopik.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# PowerShell: Get Active Network Connections
- URL: https://www.filipkonopik.com/powershell-get-active-network-connections/
- Published: 2026-07-27T11:16:33.000Z
- Updated: 2026-08-06T05:46:19.000Z
- Author: Filip Konopík
- Tags: Connectivity

Need to check active (established) network connections - to see what's actively communicating over the network, or investigate unfamiliar outbound traffic? This one-liner pulls it straight from the system, matched with the process behind each connection.

Prerequisites:

- Privileges: None
- Module: Built-in, no import needed

Quick Command:

```Powershell
Get-NetTCPConnection -State Established | Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, @{Name="ProcessName"; Expression={(Get-Process -Id $_.OwningProcess).ProcessName}}
```

Example Output:

```Powershell
LocalAddress  : 192.168.1.100
LocalPort     : 54013
RemoteAddress : 150.171.27.11
RemotePort    : 443
ProcessName   : msedge

LocalAddress  : 192.168.1.100
LocalPort     : 19221
RemoteAddress : 52.107.244.50
RemotePort    : 443
ProcessName   : OneDrive.Sync.Service
```

📦

****Want all of them at once?**  
Get every free one-liner from this blog in a single downloadable bundle organized by category, each with full comment-based help. No more copy-pasting one at a time.

[Get the Complete Bundle for $39](https://gum.co/u/oczvkqdc?ref=filipkonopik.com)

How It Works:

- \-State Established filters for connections that are actively communicating - a completed handshake between your machine and a remote server, unlike Listen (waiting for incoming connections) or TimeWait (a connection closing down).
- LocalAddress/LocalPort show your machine's side of the connection, while RemoteAddress/RemotePort show the server it's talking to - RemotePort 443 means HTTPS traffic in almost all cases.
- The calculated property pulls the process name from OwningProcess, same technique as the previous "which process is listening" article - here it shows exactly which application (browser, sync service, background agent) owns each active connection.