TCPView for Windows

Quick summary

TCPView is a free tool that displays detailed information about all active TCP and UDP endpoints on your Windows PC. It shows which processes opened each connection, the local and remote addresses involved, the protocol and connection state, and updates automatically so you can monitor network activity in real time. A companion command-line utility (Tcpvcon) provides the same functionality for scripts or terminal use.

Primary capabilities

• Identifies the process or service that owns each network endpoint.
• Lists the protocol type (TCP or UDP) for every entry.
• Shows local IP and port information for connections.
• Displays remote IP/host and port details when available.
• Indicates connection status (for example, ESTABLISHED, LISTENING).
• Resolves numeric IPs to hostnames when address resolution is enabled.
• Lets you close selected TCP/IP connections directly from the interface.

User interface and what you’ll see

When you start TCPView a window opens with columns for protocol, owning process, local address, remote address, and state. The layout is straightforward and focused on making the most important information easy to scan. Changes are highlighted so you can spot activity at a glance:

• New endpoints appear highlighted in green.
• Recently removed endpoints are shown in red.
• Entries that changed since the last refresh are marked in yellow.

You can toggle address resolution to display hostnames instead of raw IPs, and the column headers let you sort or organize the list as needed.

How to start and control monitoring

Launching TCPView immediately enumerates all active TCP and UDP endpoints and begins resolving addresses (if enabled). By default, the display refreshes once per second, but you can change the interval through Options > Refresh Rate. To manage connections:

• Right-click an entry or use File > Close Connections to terminate a selected TCP connection.
• Use toolbar buttons or the menu to toggle resolving names and to pause or resume updates.
• Save the current window contents to a file via the Save option for later analysis.

Command-line usage and saving output

Tcpvcon is the command-line equivalent of TCPView and functions similarly to Windows’ built-in netstat utility, but with Tcpvcon you get the same detailed, process-oriented output that TCPView provides. Both tools can write their output to files or folders for logging or troubleshooting.

When TCPView is useful

TCPView is helpful for anyone wanting to understand what network activity is happening on their computer: troubleshooting why a browser request is slow, confirming which services are listening on which ports, inspecting game or antivirus network behavior, or tracking outbound connections. It’s a practical, user-friendly replacement for the standard Netstat tool and a solid alternative to third-party utilities like CurrPorts.