TCPView is a network-monitoring utility that identifies active TCP and UDP endpoints, their addresses, connection states, and owning processes, helping users investigate unexpected network activity.
TCPView displays the TCP and UDP endpoints currently active on a computer and associates each endpoint with its owning process. Its continuously refreshed table shows local and remote addresses, ports, and TCP connection states, giving users a direct view of how applications communicate over a network. Address resolution can translate numerical IP addresses into recognizable domain names, while process and service details help identify the software behind each connection. TCPView is useful when troubleshooting connectivity, examining unexplained traffic, confirming whether an application has opened a connection, or observing how network activity changes while a program starts, runs, and closes.
The color-coded display makes changing network activity easier to follow: new endpoints appear in green, recently changed endpoints in yellow, and deleted endpoints briefly in red. Users can adjust the refresh interval, switch name resolution on or off, close an established TCP connection, and save the displayed results for later review. TCPView also includes Tcpvcon, a command-line companion that can list endpoints, filter by a process name or identifier, suppress address resolution, and produce CSV output for further analysis. Developers investigating application networking may also find Windows Software Development Kit – Windows 10.0.26100.4188 useful when assembling a broader Windows development and diagnostic toolkit.
TCPView shortens network troubleshooting by placing connection details and process ownership in one readable interface. Instead of correlating separate command outputs, users can immediately see which application owns an endpoint, where it is communicating, and whether a TCP session is listening, established, or changing state. This visibility helps distinguish expected application traffic from connections that deserve investigation, diagnose services that fail to listen on an intended port, and verify whether closing an application also removes its endpoints. Color highlighting draws attention to changes without requiring constant manual comparison, while configurable refresh timing supports either close observation or a calmer overview. The ability to close an established connection provides a focused way to interrupt a specific session during testing or investigation, although the responsible application may reconnect. Saving results supports documentation and comparison, and Tcpvcon extends the same core inspection workflow to scripts, terminal-based diagnostics, and CSV-oriented analysis.
Key capabilities and highlights.
TCPView enumerates active TCP and UDP endpoints in a single table. Users can inspect local addresses and ports alongside remote connection details, making it easier to understand which network resources are open and where active communications are directed.
Each endpoint is associated with the process that owns it, including a service name when one is available. This connection-to-process mapping helps users trace network activity back to a specific application or service without manually correlating separate diagnostic results.
The interface reports TCP connection states so users can distinguish listening endpoints from active sessions and other stages of the connection lifecycle. This context is valuable when diagnosing connection failures, unexpected listeners, or applications that leave sessions open.
TCPView can resolve IP addresses to domain names for a more recognizable view of remote systems. A toolbar or menu control lets users disable resolution when numerical addresses are preferable for precise investigation or faster visual comparison.
Network changes are highlighted between refreshes: new endpoints appear in green, changed endpoints in yellow, and removed endpoints in red. These visual cues help users notice short-lived connections and state transitions that might otherwise pass unnoticed.
Users can change how frequently TCPView refreshes its endpoint list. A shorter interval supports close observation of rapidly changing application traffic, while a longer interval can make the display easier to examine during routine troubleshooting or documentation.
An established TCP connection can be selected and closed from the menu or its context menu. This gives testers and administrators a targeted way to interrupt a session and observe application behavior, though the owning program may establish another connection.
The included Tcpvcon utility brings endpoint inspection to the command line. It can show all endpoints, filter results by process name or identifier, omit address resolution, and emit CSV data for scripts, repeatable diagnostics, or structured analysis.
Browse historical releases and previous builds.
No old versions have been added yet.
Common questions about TCPView.
TCPView shows active TCP and UDP endpoints, including local and remote addresses, ports, TCP connection states, and the process that owns each endpoint. It can also display an associated service name when that information is available.
Yes. TCPView reports the owning process for each listed endpoint, helping users connect observed network activity to a particular application or service.
Green marks newly created endpoints, yellow indicates endpoints whose state changed since the previous refresh, and red identifies endpoints that were deleted. The highlighting makes brief changes easier to recognize.
TCPView can close a selected TCP connection that is in the established state. This interrupts that specific session, but the owning application may reconnect automatically if it is designed to maintain communication.
TCPView provides a graphical, continuously refreshed table, while Tcpvcon provides similar endpoint information through the command line. Tcpvcon is useful for terminal workflows, process-based filtering, scripts, and CSV output.
TCPView is a network-monitoring utility that identifies active TCP and UDP endpoints, their addresses, connection states, and owning processes, helping users investigate unexpected network activity.
Remote Desktop Connection Manager organizes and controls multiple remote desktop sessions, helping administrators group servers, reuse connection settings, monitor active sessions, and switch between managed systems from one workspace.
Mihomo is a headless, rule-based proxy core that reads a YAML configuration and routes each connection through the proxy or direct path you specify, serving as the engine behind many Clash-style desktop and mobile clients.
Sysinternals Suite is a collection of advanced utilities for inspecting processes, monitoring system activity, troubleshooting problems, analyzing security settings, and administering computers.
PRTG Desktop is the native client for Paessler's monitoring platform: it connects to one or several PRTG servers at once, shows devices, sensors, and alarms in a single window, and lets administrators edit monitoring objects without opening a browser.
Comments