Our verdict: TCPView is a quick, free way to see which programs on your PC are talking to the network and where. It is a friendlier, live version of netstat. It shows connections but not traffic contents, and it cannot block anything permanently.
About TCPView
TCPView is a Sysinternals tool by Mark Russinovich, published by Microsoft. It lists all TCP and UDP endpoints on the system with local and remote addresses, connection state and the process and service that own each one. Addresses are resolved to host names, which you can switch off.
The list refreshes every second by default: new endpoints appear in green, changed ones in yellow and closed ones in red. You can close an established TCP connection from the context menu and save the list to a file. The download also includes Tcpvcon, a command-line version similar to netstat.
What it does well
- All endpoints. Lists every TCP and UDP endpoint with addresses and state.
- Owning process. Shows the process and service behind each connection.
- Live highlighting. Colours new, changed and closed connections.
- Close connections. Ends established TCP connections from the context menu.
- Tcpvcon. Command-line version with CSV output for scripts.
Who it is for
Good fit
Users and IT staff checking which app is connecting to the internet or holding a port open.
Look elsewhere
Inspecting packet contents (use Wireshark) or blocking apps permanently (use a firewall).
Pros and cons
Pros
- Clear live view of all connections
- Shows the owning process and service
- Official Microsoft tool, no ads
- Portable, includes a command-line version
Cons
- Does not show traffic volume history or packet contents
- Closing a connection is temporary; the app can reconnect
- Closed source
How to install TCPView
Download the ZIP from Microsoft Learn, extract it and run tcpview64.exe. Accept the Sysinternals license on first launch. Run it as administrator to see details for all processes, and turn off name resolution if the list updates slowly.
Questions about TCPView
Is TCPView free?
Yes. TCPView is a free Sysinternals tool from Microsoft.
What do the colours in TCPView mean?
Green rows are new endpoints, yellow rows changed state since the last update and red rows were closed.
Is there a command-line version?
Yes. Tcpvcon is included in the download and works like netstat, with an option for CSV output.
