TCPView

TCPView, shown in Figure A-4, is a real-time network connection monitor that displays a detailed list of all TCP and UDP connections. Details include the process associated with the connection, the protocol used, local and remote connection addresses, and the current state of the connection.

Figure A-4

When you start TCPView it will enumerate all active TCP and UDP endpoints, resolving all IP addresses to their domain name versions. You can use a toolbar button or menu item to toggle the display of resolved names.

By default, TCPView updates every second, but you can use the Options Refresh Rate menu item to change this rate. Changes in connection state from one update to the next are highlighted in yellow; connections that are closed are shown in red, and new connections are shown in green.

You can close established TCP/IP connections (those labeled with a state of ESTABLISHED) by selecting File Close Connections, or by right-clicking on a connection and choosing Close Connections from the resulting context menu.

You can also save TCPView’s output window to a file using the Save menu item.