PowerShell: Get Active Network Connections
Need to check active (established) network connections - to see what's actively communicating over the network, or investigate unfamiliar outbound traffic? This one-liner pulls it straight from the system, matched with the process behind each connection.
Prerequisites:
- Privileges: None
- Module: Built-in, no import needed
Quick Command:
Get-NetTCPConnection -State Established | Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, @{Name="ProcessName"; Expression={(Get-Process -Id $_.OwningProcess).ProcessName}}Example Output:
LocalAddress : 192.168.1.100
LocalPort : 54013
RemoteAddress : 150.171.27.11
RemotePort : 443
ProcessName : msedge
LocalAddress : 192.168.1.100
LocalPort : 19221
RemoteAddress : 52.107.244.50
RemotePort : 443
ProcessName : OneDrive.Sync.Service📦
Want all of them at once?
Get every free one-liner from this blog in a single downloadable bundle organized by category, each with full comment-based help. No more copy-pasting one at a time.
Get every free one-liner from this blog in a single downloadable bundle organized by category, each with full comment-based help. No more copy-pasting one at a time.
How It Works:
- -State Established filters for connections that are actively communicating - a completed handshake between your machine and a remote server, unlike Listen (waiting for incoming connections) or TimeWait (a connection closing down).
- LocalAddress/LocalPort show your machine's side of the connection, while RemoteAddress/RemotePort show the server it's talking to - RemotePort 443 means HTTPS traffic in almost all cases.
- The calculated property pulls the process name from OwningProcess, same technique as the previous "which process is listening" article - here it shows exactly which application (browser, sync service, background agent) owns each active connection.