Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If I type "netstat", I can see a list of IP addresses that my PC is connected to.

If I start with an IP address, how do I find the process that has opened the connection to said IP address?

share|improve this question
Which operating system is this on? – EightBitTony Dec 11 '12 at 10:50
Optionally see… – Hennes Dec 11 '12 at 11:27

I find following command quite convenient

netstat -nap --ip 
share|improve this answer

1- open cmd > netstat -ano

2- you will see a column says PID with a number

3- open task manager, go to processes tab, and select "view" menu while you are on this tab

4- then choose "select column" and add PID

Now you will see what the PID from the netstat command is bind to

share|improve this answer

You're going to want to use either lsof or fuser.

lsof has an easier syntax, plus it directly shows all relevant info including the process executable name:

lsof -i @address
share|improve this answer

You can use sockstat -c | grep IP.IP.IP.IP.

Without grep the output looks like this.

hennes   sshd       74693 3  tcp4
hennes   sshd       74693 4  stream -> ??
root     sshd       74690 3  tcp4
root     sshd       74690 5  stream -> ??
hennes   ssh        72543 3  tcp6   2001:610:1108:5011::68:637622001:610:1108:5010::159:22
hennes   sshd       84193 3  tcp4
hennes   sshd       84193 4  stream -> ??
root     sshd       84190 3  tcp4
root     sshd       84190 5  stream -> ??
postfix  pickup     84095 7  dgram  -> ??
hennes   tf-50b8    61863 3  tcp6   2001:610:1108:5011::68:612482001:610:1108:5011::70:3333
root     sshd       75997 3  tcp6   2001:610:1108:5011::68:222001:610:1108:5011:2e0:81ff:fe2d:e87c:54441
root     sshd       75997 5  stream -> ??
hennes   irssi      46812 3  tcp4
hennes   irssi      46806 3  tcp4
hennes   ssh        91455 3  tcp6   2001:610:1108:5011::68:543982001:610:1108:5010::135:22

With grep you simple filter so it only shows the desired IP, but the header is also lost.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.