Microsoft Sysinternals TCPView: review, download and setup

What is Microsoft Sysinternals TCPView used for?

Microsoft Sysinternals TCPView shows the network endpoints of TCP and UDP on the Windows computer and links them to processes. The table shows local and remote addresses, and for TCP - the state of the connection. The program is useful when you need to find out which application supports the connection or listens to the network port on a particular computer.

Start with the playable: open one program, follow a query and see which lines appear. One application can create multiple connections, and the browser can access different servers. The number of lines is not a sign of infection. Write down the process name, the time and the address you want to check.

TCPView: process, address and connection status

Allowing addresses to names helps to read the table, but the name itself does not prove the ownership of the connection of the desired company. In the official interface, the name resolution can be switched. When diagnosed, compare the numeric address and name, and then match them with the application action.

TCPView updates the list and highlights color changes: new, changed and disappearing endpoints. This helps to observe the sequence of events. Follow the selected process, not the overall change of colors. The line that disappeared between the updates could describe a short request that the app completed routinely.

Download Microsoft Sysinternals TCPView from the official website

Select the supported platform on the project page. The link leads to the selection of the distribution, and does not start the installation automatically.

Use the official download address. Check the signature or checksum if the project publishes one. Keep secret configuration files private when contacting support.

Getting started with Microsoft Sysinternals TCPView

1. Open the official Microsoft Sysinternals TCPView page and select the Microsoft download offered.
2. Unpack the package in a separate folder and read the terms of use.
3. Run TCPView, find the famous application and fix the original state.
4. Repeat one network action and match the lines that have appeared with the process.
5. If necessary, switch the name resolution and write down the addresses and state of the connection.
6. Before the publication of diagnostic data, delete unnecessary local addresses, names and information about work services.

Microsoft Sysinternals TCPView interface and illustrations

Interface screenshots

The origin of the images is indicated in the sources below. The interface of the installed version may differ.

Microsoft Sysinternals TCPViewMicrosoft Sysinternals TCPView: processes and network connections

1 / 1

Enlarge

1 of 1. Microsoft Sysinternals TCPView: Microsoft Sysinternals TCPView: processes and network connections

1

Microsoft Sysinternals TCPViewMicrosoft Sysinternals TCPView: processes and network connections · 1 / 1

Original in a new tab

Limitations and data protection in Microsoft Sysinternals TCPView

TCPView does not display packet contents or decrypt HTTPS. Use a suitable protocol analyzer and obtain the necessary access before inspecting traffic contents. A process name alone does not verify an executable’s signature or origin.

The program has the operation of closing the installed TCP connection. Do not use it as the first step: you can cut off the transfer, a remote session or the application. First, keep the observation you need and find out the purpose of the connection. Closing the connection does not remove the program and does not eliminate the possible cause of its network activity.

Alternatives for related tasks

Angry IP Scanner helps to investigate the responding devices in the allowed subnet. Wireshark works with the capture and parsing of traffic. TCPView connects endpoints with processes on Windows and is suitable for the first observation of a specific application. Combine the results if the issue requires several levels of diagnosis.

Documentation and images