Find listening TCP ports
Documentation: Microsoft Learn
Get-NetTCPConnection with -State Listen returns only sockets sitting in the listening state rather than the full connection table.
The script
Script reader
Inspect before you run
Inspect the script below. It does not run in this browser.
Inspection only — no command has run.
Show reference output
Inspect this example’s structure
Read the command and its supplied arguments. This example requires real PowerShell or its module; this diagram does not execute it.
Get-NetTCPConnection -State Listen | Select-Object LocalAddress,LocalPort,OwningProcess- Stage 1Get-NetTCPConnection
-State - Stage 2Select-Object
Positional values or no named parameters
How it works
Get-NetTCPConnection with -State Listen returns only sockets sitting in the listening state rather than the full connection table. Select-Object keeps the bound address, the port, and OwningProcess, which is the PID of whatever opened it.
Adapting it
Resolve that PID inline with a calculated property that calls Get-Process -Id, or filter LocalPort against the range the application owner claims their service uses.
If the result is unexpected
The port you expected is absent from the output, or every service appears twice with different local addresses.
A socket bound to both IP stacks yields separate rows for the IPv4 and IPv6 wildcards, which reads as duplication. A missing port usually means the service bound to a specific address rather than the wildcard, or it is listening on UDP, which this cmdlet does not cover. Sockets in other states also drop out of a listen-only view.
- Rerun without the state filter and check whether the port appears in a different state.
- Use Get-NetUDPEndpoint for anything that might be a UDP service, since the TCP cmdlet will never show it.
- Compare against netstat -ano to confirm the port is genuinely absent rather than filtered out by a parameter.
- Check the service's own binding configuration for a specific address instead of a wildcard.
- Group on LocalPort to collapse the dual-stack duplication into a single row per port.
Validate the result
The port appears once per bound address, and the count of distinct LocalPort values matches the services this host is supposed to expose.
Keep the check reliable
Query both the TCP and UDP endpoint cmdlets in any port audit, and deduplicate on port so a dual-stack listener is not counted twice.
