Guide · Windows networking

How to see which programs connect to the internet on Windows

Windows has four built-in ways to find out which applications are talking to the internet. Each answers part of the question. Here's how to use them, and where they stop.

1. Resource Monitor: the quickest look

Press Win + R, type resmon and open the Network tab. Expand TCP Connections to see each program (the Image column), its process ID and the remote address and port it's connected to right now.

Good for a quick check on one PC. It shows only current connections, and nothing about who owns the remote address.

2. netstat: a snapshot you can save

Open Command Prompt as administrator and run:

netstat -abno

-b prints the executable behind each connection, -n keeps addresses numeric (faster), and -o adds the process ID. Redirect it to a file to compare later: netstat -abno > connections.txt.

It's a single moment in time. A program that connects for two seconds every hour won't show up unless you happen to run it then.

3. PowerShell: filter and sort

PowerShell can match each connection to the program's full path, skip local traffic and sort the result:

Get-NetTCPConnection -State Established |
  Where-Object RemoteAddress -notmatch '^(127\.|::1)' |
  Select-Object RemoteAddress, RemotePort,
    @{n='Process'; e={ (Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).Path }} |
  Sort-Object Process | Format-Table -AutoSize

For UDP (DNS, video calls, QUIC), Get-NetUDPEndpoint lists the local ports each process has open, but Windows doesn't report a remote address for UDP here.

4. Windows Firewall logging: a history, without names

In Windows Defender Firewall with Advanced Security, open the properties for your active profile, choose Logging → Customize, and turn on logging for dropped and successful connections. Windows writes them to %systemroot%\system32\LogFiles\Firewall\pfirewall.log.

You get a record over time, but the log shows addresses and ports only, not which program made the connection.

Who owns that address?

An address like 150.171.22.17 means little on its own. Try a reverse lookup:

Resolve-DnsName 8.8.8.8 -Type PTR

Many addresses have no reverse name. For those, a WHOIS or RDAP lookup on the address shows the network that owns it, such as Microsoft, Google or a hosting provider.

Where the built-in tools stop

One PC at a time. Each tool runs on the machine in front of you.
No memory. Resource Monitor, netstat and PowerShell show the present; the firewall log has history but no program names.
No context. You look up every address's owner by hand.
No action. Blocking a program means writing firewall rules device by device.

Doing this across many devices?

ShadowLatch records which program on which device connected where, adds the owner and location of every address, keeps up to six months of history, and lets you block an app or destination across your fleet from one console.

Request beta access See the product