How to Check Open Ports Using CMD & PowerShell (Windows 11 & Linux)
Master the exact command-line workflows to discover listening TCP/UDP sockets, map active ports to background process IDs (PIDs), test socket reachability, and create defensive firewall rules on Windows 11 and modern Linux servers.
Check Open Ports in Windows Command Prompt (CMD)
The classic netstat (Network Statistics) utility is universally baked into every version of Windows without requiring administrative scripts or PowerShell modules.
List All Active Listening Ports with PIDs
The -a flag displays all connections/listening ports, -n displays numerical IP addresses rather than slow reverse DNS names, and -o displays the owning Process ID (PID).
Filter by a Specific Port (e.g., Port 80, 443, or 25565)
Find the Application Name from the Process ID (PID)
The last number on the right in netstat output is the PID. Use tasklist to discover which executable (e.g., java.exe, node.exe, nginx.exe) owns that PID:
Check Open Ports in Modern Windows PowerShell
PowerShell offers object-oriented native cmdlets that provide clean structured data rather than unstructured plain text streams.
View Listening Ports Mapped Directly to Process Names
Run this single command in PowerShell 5.1 / 7+ to get an instant tabular view of the Local Address, Port, PID, and executable Process Name:
Check if a Specific Port is Currently Bound
Test Socket Reachability with Test-NetConnection
In earlier Windows releases, administrators had to enable optional Telnet clients. In Windows 11/10, Test-NetConnection (alias tnc) conducts a real three-way TCP handshake to test any internal or external socket:
Test Local Port (Verify Daemon Accepts Connections)
Look for TcpTestSucceeded : True in the output. If it returns False, your service is stopped or crashed.
Test Remote Server or Router WAN IP
Linux Equivalents: ss, lsof & nc (netcat)
On Linux servers (Ubuntu, Debian, CentOS, AlmaLinux), netstat has been deprecated in favor of ss (Socket Statistics) because ss reads directly from kernel /proc/net without process iteration lag.
1. Fast Kernel Socket Inspection with `ss`
-t (TCP), -u (UDP), -l (Listening only), -p (Show process/PID), -n (Numeric ports):
2. Find Process by Port with `lsof`
3. Test Outbound TCP Port Reachability with Netcat (`nc`)
How to Allow Inbound Ports in Windows Firewall
Even after configuring router port forwarding, Windows Defender Firewall will reject unsolicited inbound packets by default. You can open specific ports safely via PowerShell Administrator:
Create an Inbound Allow Rule for TCP (e.g., Port 25565)
Linux ufw Equivalent (Ubuntu/Debian)
Troubleshooting Common Socket & Firewall Errors
| Symptom / Error | Underlying Cause | Actionable Resolution |
|---|---|---|
| Socket CLOSED / ECONNREFUSED | Server is bound to 127.0.0.1 or service process stopped. | Change listen host in server config to 0.0.0.0. Restart daemon. |
| Timeout / FILTERED | Firewall dropped packet or router forwarding rule missing. | Add inbound firewall allow rule; check router WAN forwarding and CGNAT. |
| EADDRINUSE (Address already in use) | Another process is already bound to that port. | Find PID with Get-NetTCPConnection, then terminate with Stop-Process -Id <PID>. |
Ready to verify external reachability?
Test whether your forwarded ports can be accessed from the public internet using our edge TCP engine.