Open the Sysinternals TCPView tool (tcpview.exe).
View the complete list of processes and associated ports, which are displayed by default. New connections show up in green and terminating connections show up in red.
Using a command-line interface
The Sysinternal's pslist command displays all of the performance metrics for a process:
> pslist -x <ProcessName>
In place of <ProcessName>, put the name of the process without its extension. For example:
> pslist -x iexplore
To view the DLLs being used by a process, use the listdll command available from Sysinternals:
> listdlls <ProcessName>
To view the processes using a specific DLL, use the following command:
> listdlls -d <DLLName>
To view all of the handles a process has open, use the following command:
> handle -a -p <ProcessName>
You can also search for a specific handle using the following command:
> handle <HandleName>
For example, if you want to find all processes that have the c:\test directory open, you would replace <HandleName> with c:\test.
The following command displays the open ports and the process ID of the process associated with the port. The -o option is new to netstat.exe in Windows XP:
> netstat -o
The Sysinternals netstatp.exe command is similar to netstat.exe, except it displays the process name associated with each port (not just the PID):
And for yet another extremely useful port querying tool, check out portqry.exe (see MS KB 310099 for more information). With portqry you can get even more information than with netstatp. Run this command to output all of the ports and their associated processes:
> portqry -local
This command also breaks port usage down by service (e.g., DnsCache). You can watch the port usage for a particular PID and log it to a file. The following command does this for PID 1234:
> portqry -wpid 1234 -wt 5 -l portoutput.txt -v
The -wt defines the watch time, which is how long portqry waits before examining the process again (the default is 60 seconds). The -v option is for verbose output.
There are no APIs available to VBScript to query the DLLs, which handles, and which network connections a process is using, but you can use WMI to retrieve memory and CPU usage as shown here:
' This code displays the performance stats of a process. ' ------ SCRIPT CONFIGURATION ------ intPID = 3280 ' PID of target process strComputer = "." ' ------ END CONFIGURATION --------- WScript.Echo "Process PID: " & intPID set objWMIProcess = GetObject("winmgmts:\\" & strComputer & _ "\root\cimv2:Win32_Process.Handle='" & intPID & "'") arrProps = Array("Name", "KernelModeTime", "UserModeTime", _ "MaximumWorkingSetSize", "MinimumWorkingSetSize", _ "PageFaults", "PageFileUsage", "VirtualSize", _ "WorkingSetSize", "PeakPageFileUsage", "PeakVirtualSize", _ "PeakWorkingSetSize", "PrivatePageCount", _ "QuotaNonPagedPoolUsage", "QuotaPagedPoolUsage", _ "QuotaPeakNonPagedPoolUsage", "QuotaPeakPagedPoolUsage", _ "ThreadCount") for each strProp in arrProps WScript.Echo strProp & ": " & objWMIProcess.Properties_(strProp) next
If you need to get serious about analyzing performance statistics for one or more processes, you should consider using Performance Monitor (perfmon.exe). With the Process performance object (click the little + icon in the System Monitor and select Process under Performance object), you can graph a variety of metrics for individual processes or for all of them together using the _Total instance. Even if you don't want to use Performance Monitor to monitor processes, it can still be useful if you have a question about what a particular metric, such as Working Set, really means. Click the Explain button when you view the Process performance object, which will cause another dialog to appear that contains additional information about what each counter means. These counters are mostly the same ones you'll find in Task Manager, pslist, and the Win32_Process class.
MS KB 137984, "TCP Connection States and Netstat Output," and MS KB 310099, "Description of the Portqry.exe Command-Line Utility"