List ports that are listening on all interfaces, along with the process to which they are attached.
To learn more about queries, check this guide
SELECT lp.address, lp.pid, lp.port, lp.protocol, p.name, p.path, p.cmdline FROM listening_ports lp JOIN processes p ON lp.pid = p.pid WHERE lp.address = "0.0.0.0";
# Retrieve listening TCP connections with LocalAddress "0.0.0.0" $tcpConnections = Get-NetTCPConnection -State Listen -ErrorAction SilentlyContinue | Where-Object { $_.LocalAddress -eq '0.0.0.0' }
# Retrieve process details (includes name, executable path, and command line) $procDetails = Get-CimInstance -ClassName Win32_Process
# Build a lookup table for processes keyed by ProcessId $procLookup = @{} foreach ($proc in $procDetails) {
$procLookup[$proc.ProcessId] = $proc
}
$results = foreach ($conn in $tcpConnections) {
$proc = $procLookup[$conn.OwningProcess]
[PSCustomObject]@{
address = $conn.LocalAddress
pid = $conn.OwningProcess
port = $conn.LocalPort
protocol = 'TCP'
name = if ($proc) { $proc.Name } else { 'N/A' }
path = if ($proc) { $proc.ExecutablePath } else { 'N/A' }
cmdline = if ($proc) { $proc.CommandLine } else { 'N/A' }
}
}
$results | Format-Table -AutoSize
PowerShell commands are currently work in progress, contributions welcome.