I'm not trying to find established TCP connections. I have a Windows 2008 R2 server and my host-based L3 firewall is showing one TCP connection ATTEMPT to a remote address. The connection is not established as the servers are not allowed to communicate on the gateway firewall. What's the easiest and non-obtrusive way to find out this process? I cannot install sniffing tools like Wireshark on this server due to security reasons.


1 Answer 1


Given your access restrictions, you can do this:

  1. Task Manager > View > Select Columns > PID
  2. netstat -ano | find "" (put whatever IP you want in the quotes)
  3. Compare PID to active connections.

More information on how to use find, and netstat

  • 1
    What about netstat -ano 1 | find "remote address"? Commented Oct 29, 2015 at 5:13
  • 1 means it's refreshing every second. If you want to do that, sure. Here's more info on find. Commented Oct 29, 2015 at 5:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .