I'm not trying to find established TCP connections. I have a Windows 2008 R2 server and my host-based L3 firewall is showing one TCP connection ATTEMPT to a remote address. The connection is not established as the servers are not allowed to communicate on the gateway firewall. What's the easiest and non-obtrusive way to find out this process? I cannot install sniffing tools like Wireshark on this server due to security reasons.


Given your access restrictions, you can do this:

  1. Task Manager > View > Select Columns > PID
  2. netstat -ano | find "" (put whatever IP you want in the quotes)
  3. Compare PID to active connections.

More information on how to use find, and netstat

  • What about netstat -ano 1 | find "remote address"? – security_obscurity Oct 29 '15 at 5:13
  • 1 means it's refreshing every second. If you want to do that, sure. Here's more info on find. – Mark Buffalo Oct 29 '15 at 5:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.