What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
To see which Windows apps currently have network connections, use Microsoft Sysinternals TCPView. It shows active TCP and UDP endpoints alongside the process name and local and remote addresses. For a built-in command-line check, run netstat -ano. Neither method is a complete record of every connection: brief activity can pass between TCPView refreshes, and packet capture tools see only traffic available on the interfaces you select.
Choose the right tool for the question
| Tool | What it shows | Process identification | Time and coverage |
|---|---|---|---|
| TCPView | Active TCP and UDP endpoints, including local and remote addresses and TCP state | Shows the process that owns an endpoint | Live view; refreshes every second by default. It can miss connections that start and end between refreshes. Microsoft Sysinternals |
netstat |
Active TCP connections and listening ports; numeric addresses and ports when requested | -o adds the process ID (PID), which you can match in Task Manager |
A command-line snapshot, not a historical log. Microsoft command reference |
| Wireshark | Packets visible on the interface or interfaces you choose | Does not serve as the same process-to-endpoint inventory as TCPView | Captures during the selected period; inaccessible or hidden interfaces may not appear. Wireshark capture options |
| Windows wireless network report | Wi-Fi events and adapter information | Not documented as a list of remote endpoints and owning processes | Covers Wi-Fi events from the last three days and includes hidden adapters. Microsoft Support |
View active connections with TCPView
Download and open TCPView from Microsoft Sysinternals, then inspect the process name, protocol, local address, remote address, and connection state in the list. TCPView refreshes its view every second by default; color highlighting indicates new, removed, or state-changing endpoints. If you need to retain what you saw, save the displayed output. A live list is useful for checking what is connected now, but it is not a complete history of short-lived connections.
As an Amazon Associate I earn from qualifying purchases.
Check connections from Command Prompt
- Open Command Prompt with administrator privileges if you need an elevated view, then run
netstat -ano. - Read the output:
-aincludes active TCP connections and listening ports,-ndisplays addresses and ports numerically, and-oadds each connection’s PID. - Match a PID to an application in Task Manager. Use the process identity and what the application is doing to investigate an unfamiliar connection; an unfamiliar remote address by itself does not establish that a process is malicious.
Microsoft documents the options and PID matching in its netstat reference.
Capture packets when you need more detail
Use Wireshark when an endpoint list is not enough and you need to examine packets. Select the relevant network interface, start a capture for only as long as needed, and stop it when you have the traffic you want to inspect. Packet capture answers a different question from TCPView: it records traffic visible on selected interfaces rather than listing active endpoints with their owning processes.
#1 Best Overall
- VERSATILE CABLE TESTING: Cable tester for data (RJ45) terminated cables and patch cords, ensuring comprehensive testing capabilities
- LARGE BACKLIT LCD: Backlit LCD display enables easy reading of pin-to-pin wiremap results, even in low-lit areas
- COMPREHENSIVE FAULT DETECTION: Test for Open, Short, Miswire, Split-Pair faults, Cross-over, and Shield, providing thorough fault detection
- INTUITIVE USER INTERFACE: User-friendly interface with three buttons and simple, easy-to-identify test responses, ensuring a smooth testing experience
- MULTIPLE TONE GENERATOR STYLES: Tone on a single wire, wire pair, or all 8 conductor wires using the multiple style tone generator (solid/warble); requires probe Cat. No. VDV500-123 (sold separately)
Coverage depends on what interfaces are available to you. Wireshark notes that inaccessible or hidden interfaces may not appear, so a capture should not be treated as proof that no other network activity occurred. Captured traffic can expose network metadata and sometimes application data; encryption may prevent the contents from being readable.
Use the Wi-Fi report for wireless history
Windows’ wireless network report is for reviewing Wi-Fi events, not for finding every internet connection or identifying the process responsible for each one. Microsoft says the report covers the last three days of Wi-Fi events and lists adapters, including hidden adapters. See Microsoft’s guide to analyzing the wireless network report.
Rank #2
- VERSATILE CABLE TESTING: Cable tester tests voice (RJ11/12), data (RJ45), and video (coax F-connector) terminated cables, providing clear results for comprehensive testing on unenergized Ethernet cables (not designed to test PoE)
- EXTENDED CABLE LENGTH MEASUREMENT: Measure cable length up to 2000 feet (610 m), allowing for precise cable length determination
- COMPREHENSIVE FAULT DETECTION: Test for Open, Short, Miswire, or Split-Pair faults, ensuring thorough fault detection and identification
- BACKLIT LCD DISPLAY: Backlit LCD screen displays cable length, wiremap, cable ID, and test results, ensuring easy readability in various lighting conditions
- EFFICIENT CABLE TRACING: Trace cables, wire pairs, and individual conductor wires using the multiple style tone generator (requires analog probe Cat. No. VDV500-123, sold separately), simplifying cable tracing tasks
Why background activity can be normal
Windows connected experiences can send and process data at Microsoft to provide those experiences. Seeing background network activity therefore does not, on its own, indicate malware. Identify the process and consider whether its activity makes sense before taking action. Microsoft explains connected experiences in Windows.
What “every connection” can and cannot mean
No single view described here proves a complete inventory across all times, interfaces, and system contexts. TCPView and netstat show endpoint activity available when you inspect them; Wireshark captures traffic available on selected interfaces during its capture; the Wi-Fi report is limited to its documented event window. For a practical check, begin with TCPView to associate visible endpoints with processes, use netstat -ano to cross-check PIDs, and turn to Wireshark only when packet-level detail is necessary.
Quick Recap
Best Value
- Multi-Function Network Cable Tester: Supports RJ45 (CAT5, CAT5e, CAT6, CAT6A, CAT7) and RJ11 telephone cables. Quickly detects continuity, short circuits, open wires, miswiring, and cable shielding status, ensuring your LAN or phone lines are correctly wired and ready to use.
- Fast/Slow Mode with LED Indicators: Switch between fast and slow scan speeds to identify wiring issues more precisely. LED lights on both master and remote units show wire order, making it easy to spot errors like open pairs or misaligned pins at a glance.
- Split-Type Design for Long-Distance Testing: Master and remote units can be detached and used separately, allowing you to test both ends of a long cable run, ideal for wall-mounted ports, long runs, or structured cabling. Perfect for home, office, or professional IT setups.
- Compact, Lightweight & Durable: Ergonomically designed with sturdy ABS housing, this pocket-sized tester is ideal for on-the-go network engineers, DIYers, and electricians. It’s your go-to toolkit for cable maintenance, upgrades, or new installations.
- Safe & Easy to Use: Simple one-button operation makes testing quick and hassle-free. LED indicators clearly show wiring status, while the G light instantly identifies shielded (FTP/STP) or unshielded (UTP) cables. Supports safe testing of telephone lines with typical voltages under 48-72V, ideal for both home and professional use.
Rank #4
- Automatically runs all tests and checks for continuity, open, shorted and crossed wire pairs. Visible LED status display.
- Cable state testing (2-wire): Line DC detecting, anode and cathode determination,Ringing signal detecting open, short and cross circuit testing
- Cable Type: RJ11 Telephone cable and RJ45 LAN cable
- Connectors: Ethernet Cat 5, Ethernet Cat 5e, Ethernet Cat 6, Ethernet Cat 7, RJ11 6P and RJ45 8P
- Power Source: DC9V Battery Required (not included)
Rank #3
- Multifunctional NOYAFA NF-8508 Network Cable Tester: There are nine features to meet your needs. Continuity Testing, Cable Scan, Port Flash, Length Measurement, POE Power Supply Test, QC testing, Optical Power Meter, VFL and NVC function.It is perfectly suited for various engineering cabling projects, network troubleshooting, network equipment maintenance and testing scenarios. Its precise cable scanning and fault localization capabilities help you effortlessly pinpoint the root cause of issues.
- 7 WAVELENGTHS OPTICAL POWER METER: NF-8508 network cable tester can measure 7 standard wavelengths, 850/1300/1310/1490/1550/1625/1650, power detecting range(dBm): -70 ~ +10. Its power detection range spans from -70 dBm to +10 dBm, supporting FC/SC/ST connectors. It enables precise fiber optic power measurement, helping users efficiently assess fiber signal strength and ensure healthy fiber link operation. It effortlessly detects attenuation issues within fibers, thereby safeguarding fiber network stability.
- High Efficiency Visual Fault Locator: Easy identification of fiber breakpoints, poor connections, bending or cracking. Excellent for finding the right fiber to splice or quickly finding a break. Emmiting Energy: standard wavelenth: 650nm. Fast flashing, slow flashing, high precison.The built-in self-calibration ensures stable long-term performance, and Class IIIa laser (output<5mW) ensures safe daily operation.
- PORT FLASHING:The indicator light on the connection port in the NF-8508 device flashes to help accurately locate the cable. Displays port information, including operating speed, duplex mode, and negotiation settings. Port lights flash on the same screen to show the port's operating speed, making it easy to pinpoint lines and ports.
- PoE Testing and Cable Length Test: PoE testing can check cable mapping polarity and voltage of PoE network switches, withstand 60VDC. Automatically detects and switches between 10M/100M/1000M modes, Includes cable tracking, short circuit test, interruption of circuit test and etc The RJ45 cable tester can quickly measure the length of the cable with a range of 200m. Not only network cables, but also phone lines and BNC cables.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
