How to Check Open Ports on Windows, Mac and Linux (and Close the Ones You Don't Need)

To check open ports on your computer, list the ports that programs are listening on and see which program owns each one. On Windows, run netstat -ano | findstr LISTENING in Command Prompt or Get-NetTCPConnection -State Listen in PowerShell. On a Mac, run sudo lsof -iTCP -sTCP:LISTEN -n -P. On Linux, run sudo ss -tulpn. Anything listening on 0.0.0.0 or [::] accepts connections from other devices, so stop the program or block the port in your firewall if you don't need it.

Every service that accepts network connections opens a port: file sharing, remote desktop, a database you installed for a course and forgot. An open port isn't automatically a problem. One you don't know about is.

This guide sticks to your own computer and each system's built-in tools: reading the output, spotting exposed services, checking what's reachable and closing what you don't need.

In this guide:

• Open, listening and established: what the terms mean
• Local only or reachable? How to read the address column
• How to check open ports on Windows with netstat
• How to check open ports in PowerShell with Get-NetTCPConnection
• What's normally listening on a Windows PC
• How to check open ports on a Mac
• How to check open ports on Linux with ss
• How to check which ports are reachable from outside
• How to close or block a port you don't need
• Firewall commands to block a port on each system
• A five-minute monthly port check
• Frequently asked questions

Open, listening and established: what the terms mean

Tools use slightly different words, so here's what they mean.

When people say "open port", they almost always mean a listening port that something else could connect to. That's what we'll focus on.

Local only or reachable? How to read the address column

The address a program listens on matters more than the port number. It decides who can reach it.

A database or dev server bound to 127.0.0.1 is fairly harmless. The same service bound to 0.0.0.0 on a laptop you take to coffee shops is worth a second look.

How to check open ports on Windows with netstat

netstat has been part of Windows for decades and works in any Command Prompt. Run it as administrator so you can see every process.

1. Press the Windows key, type cmd, right-click Command Prompt and choose Run as administrator.
2. Run netstat -ano | findstr LISTENING to list TCP listeners with the process ID (PID) in the last column.
3. Note any PID you don't recognise.
4. Look it up with tasklist /fi "PID eq 1234", replacing 1234 with the PID.
5. To check a single port, run netstat -ano | findstr :3389.

  Proto  Local Address          Foreign Address        State           PID
  TCP    0.0.0.0:135            0.0.0.0:0              LISTENING       1092
  TCP    0.0.0.0:445            0.0.0.0:0              LISTENING       4
  TCP    127.0.0.1:5432         0.0.0.0:0              LISTENING       6120

The flags mean: -a all connections and listening ports, -n numbers instead of names, and -o the owning PID. Adding -b shows the program name directly, but it's slower and needs an elevated window. UDP ports appear in the full netstat -ano output without a state. The netstat reference on Microsoft Learn lists every switch.

How to check open ports in PowerShell with Get-NetTCPConnection

PowerShell gives tidier output you can filter and sort.

1. Right-click the Start button and open Terminal (Admin) or Windows PowerShell (Admin).
2. List TCP listeners with their owning process:

Get-NetTCPConnection -State Listen |
  Select-Object LocalAddress, LocalPort, OwningProcess,
    @{n='Process';e={(Get-Process -Id $_.OwningProcess).ProcessName}} |
  Sort-Object LocalPort

1. For UDP, run Get-NetUDPEndpoint | Sort-Object LocalPort.
2. To see who's using one port, run Get-NetTCPConnection -LocalPort 3389.

The calculated Process column saves you looking up each PID by hand. Microsoft documents every parameter in the Get-NetTCPConnection reference.

Prefer a window to a command line? Press Windows + R, type resmon and open the Network tab of Resource Monitor. The Listening Ports section shows each program, its PID, address, port, protocol and whether Windows Firewall allows it.

What's normally listening on a Windows PC

A clean Windows 10 or 11 PC isn't silent. Know the usual entries before you stop anything.

Apps such as Steam, Docker, VPN clients and database servers add their own. If you see an elevation prompt while running these commands, my explainer on what UAC is in Windows covers why admin rights are needed to see other users' processes.

How to check open ports on a Mac

macOS uses the BSD version of netstat, which can't show process names, so lsof is the better tool.

1. Open Terminal (Applications > Utilities).
2. List TCP listeners with their program and PID: sudo lsof -iTCP -sTCP:LISTEN -n -P.
3. Enter your Mac password when asked. Nothing appears as you type; that's normal.
4. List UDP ports with sudo lsof -iUDP -n -P.
5. Check one port with sudo lsof -i :5000 -n -P.

COMMAND     PID   USER   FD   TYPE  DEVICE SIZE/OFF NODE NAME
ControlCe   512   you    9u  IPv4  0x...      0t0  TCP *:7000 (LISTEN)
ControlCe   512   you   10u  IPv4  0x...      0t0  TCP *:5000 (LISTEN)
postgres   1840   you    7u  IPv4  0x...      0t0  TCP 127.0.0.1:5432 (LISTEN)

-n and -P stop lsof translating addresses and ports into names, which makes it much faster and the output easier to read. Without sudo you only see your own processes. For a quick port list without process names, netstat -an -p tcp | grep LISTEN works too. The lsof manual page explains every selection flag.

A common surprise: ports 5000 and 7000 owned by ControlCenter. That's AirPlay Receiver. If you don't stream to your Mac, turn it off in System Settings > General > AirDrop & Handoff.

How to check open ports on Linux with ss

ss is the modern replacement for netstat on Linux and comes with the iproute2 package on virtually every distribution.

1. Open a terminal.
2. Run sudo ss -tulpn to list TCP and UDP listeners with their process.
3. Read the Local Address:Port column and the users:(("name",pid=...)) part at the end.
4. Check one port with sudo ss -tlnp 'sport = :22', or use sudo lsof -i :22.

Netid State  Local Address:Port  Peer Address:Port Process
udp   UNCONN 127.0.0.53%lo:53         0.0.0.0:*     users:(("systemd-resolve",pid=612,fd=13))
tcp   LISTEN       0.0.0.0:22         0.0.0.0:*     users:(("sshd",pid=901,fd=3))
tcp   LISTEN     127.0.0.1:3306       0.0.0.0:*     users:(("mysqld",pid=1220,fd=21))

The letters stand for -t TCP, -u UDP, -l listening only, -p process and -n numeric. Without sudo, the process column is blank for services owned by other users. The ss manual page covers its powerful filter syntax.

sshd on 0.0.0.0:22 is expected on a server, but on a desktop you never log in to remotely, switch it off.

How to check which ports are reachable from outside

A local listener isn't necessarily reachable. Your firewall, and at home your router, sit in between. To see what another device actually sees, test from a second machine you own.

1. Find your computer's local IP address: ipconfig on Windows, ipconfig getifaddr en0 on a Mac, or ip addr on Linux.
2. From another device on the same network, test a port. On Windows: Test-NetConnection 192.168.1.20 -Port 445. On Mac or Linux: nc -zv 192.168.1.20 445.
3. TcpTestSucceeded : True or succeeded means the port is reachable on the local network.
4. For internet exposure, check your router's port forwarding, DMZ and UPnP settings. On a typical home connection, nothing is reachable from the internet unless one of those opens it.

Only test devices and networks you own or have permission to test. Scanning other people's systems can break acceptable use policies and, in the UK, potentially the Computer Misuse Act. If your router has port forwards you don't recognise, my guide to securing your home Wi-Fi router shows where to find and remove them. Network scanners such as Nmap give a fuller picture when you're ready for them.

How to close or block a port you don't need

A port is open because a program is listening, so the cleanest fix is to stop that program rather than hide it behind a firewall. In order:

1. Identify the program from the PID using the commands above.
2. Turn the feature off in its own settings if it's something like Remote Desktop, file sharing, AirPlay Receiver or a game's host server.
3. Stop and disable the service if it's a background service you never use.
4. Uninstall software you no longer need, such as an old database server.
5. Block the port in the firewall if you need the program locally but don't want other devices reaching it.
6. Run the check again to confirm the port has gone or is now local only.

If a service sounds unfamiliar, search its exact name before disabling it. Many Windows services have odd names but are essential; my guide to what msconfig does explains how to switch services off safely and undo it.

Firewall commands to block a port on each system

On a Mac, the built-in firewall works per app rather than per port, so you allow or block a program, not a number. Apple explains the options in its guide to blocking connections with the Mac firewall.

A warning for Linux servers: if you're connected over SSH, run sudo ufw allow OpenSSH (or sudo ufw allow 22/tcp) before sudo ufw enable, or you can lock yourself out. On firewalld, removing a port only closes it if it was opened with --add-port; services opened with --add-service are removed with --remove-service.

A five-minute monthly port check

• Run the listening-ports command for your system and save the output to a text file.
• Compare it with last month's list. New entries deserve a look.
• Anything on 0.0.0.0 or [::] that you can't explain: identify it, then decide whether to stop it.
• Check that your firewall is switched on for public networks.

Saving the output makes comparison easy. On Windows, netstat -ano > ports.txt does it. On Mac and Linux, add > ports.txt to the end of the command. An unexplained new listener is a useful early warning sign.

Frequently asked questions

How do I see which program is using a port?

On Windows, run netstat -ano and look up the PID with tasklist, or use Get-NetTCPConnection with Get-Process. On a Mac, run sudo lsof -i :PORT -n -P. On Linux, run sudo ss -tulpn or sudo lsof -i :PORT and read the process column.

What does 0.0.0.0 mean in netstat?

It means the program is listening on every network interface on the computer, so other devices that can reach it may be able to connect. 127.0.0.1 means only programs on the same computer can connect.

Is it bad to have open ports?

Not necessarily. Your operating system and many legitimate apps listen on ports. The risk comes from services you don't need, services exposed to networks you don't trust, and software that's out of date. Close what you don't use and keep the rest updated.

Why does netstat show so many ports on Windows?

Windows runs many services that use the network, including RPC on port 135, file sharing on 445 and several dynamic ports between 49152 and 65535. Most of these are normal. Focus on listeners you can't match to a program you recognise.

How do I close port 445 on Windows?

If you don't share files or printers, turn off file and printer sharing for your network profile and make sure Windows Firewall is on, especially on public networks. Block it with a firewall rule rather than disabling core services you aren't sure about.

Does closing a port in the firewall stop the program?

No. A firewall rule blocks connections to the port, but the program keeps running and listening locally. To fully close the port, stop or uninstall the program or turn off the feature that opened it.

Do I need admin rights to check open ports?

You can list ports without admin rights on all three systems, but you won't see the program name for services run by other users or the system. Run the command as administrator on Windows or with sudo on Mac and Linux for the full picture.

Can a website tell me which ports are open on my computer?

An online port checker can only test your public IP address, which at home is usually your router, not your computer. To check your computer itself, use the built-in commands in this guide or test from another device you own on the same network.

Last checked: 22 October 2026. Figures, settings and guidance can change, so confirm anything important with the sources linked above.