Display which programs accept or have established Internet connections on Windows

How do you know which programs on Windows have established connections to the Internet or are accepting them? Some programs may reveal the information to you directly while others may not reveal those information to you.

This is especially true for shady applications and those that are outright malicious. If you want to know if a program phones home you need to know how to display those information on the system.

One option that you have is to configure a software or hardware firewall to only allow connections by programs that you have verified on a case by case basis.

If you just want to get the current status of connections though, you can use various internal and third-party tools to do so.

Netstat

One of the easiest options is to use the netstat command. Here is how you use it for that purpose:

1. Tap on the Windows-key and type cmd.exe.
2. Right-click on the result and select run as administrator. This launches an elevated command prompt.
3. Type netstat -bona and hit enter.

Wonder what the parameters stand for?

• b - displays the executable involved in  creating the connection.
• o - displays the owning process ID.
• n - displays address and port numbers.
• a - displays all connections and listening ports.

The command lists executable files, local and external IP addresses and ports, and the state in list form. You immediately see which programs have created connections or are listening so that you can find offenders quickly.

Windows Powershell

You can use the Powershell as well and it is offering several interesting options.

1. Tap on the Windows-key and type powershell.
2. Right-click on the result and select run as administrator. This runs it with elevated privileges.
3. Type $nets = NetStat. This saves the Netstat output in the variable $nets.
4. Type $nets | select-string "Established" to only display established connections.
5. Use the same syntax to search for other strings, e.g. listening.

Another useful command is netsh interface ipv4 show tcpconnections.

Third-party tools

The program that I find the most comfortable to use is CurrPorts by Nirsoft. It is a portable application for Windows that displays all open connections and listening ports on start.

What's great about it is that it is super easy to use and that it ships with extra features that you may find handy. You can use it to search for data for example or filters to only display specific connections.

The refresh is fast and you can export the data to other formats such as csv or xml as well.