VMware ESXi and vSphere Cluster Management
Using the TCP/IP Tab in Process Explorer
Learn how to use Process Explorer's TCP/IP tab to inspect TCP and UDP endpoints, connection states, ports, remote systems, and DNS name resolution.
What the TCP/IP Tab Shows
Process Explorer is a Windows process-inspection utility that provides detailed information about running processes. When you open the Process Properties window for an individual process, the TCP/IP tab displays active network endpoints associated with that process.
An endpoint is a network communication point identified by a protocol, address, and port. The tab can represent both TCP and UDP activity. This makes it useful for associating network activity with a particular executable or process instead of viewing connections only as system-wide entries.
Opening the Process Properties Window
- Start Process Explorer and locate the process you want to investigate.
- Select the process in the process list.
- Open its Properties window, such as by double-clicking the process or using the process context menu.
- Select the TCP/IP tab to view that process's network endpoints.
The TCP/IP tab is process-specific. If you need to know which process owns a particular network activity, select the suspected process and inspect its Properties window rather than relying only on a system-wide connection view.
Reading Endpoint Entries
Each row represents a network endpoint or connection associated with the selected process. The fields describe how the process communicates locally and, for a connection, which remote system and port are involved.
| Field | Meaning | How to use it |
|---|---|---|
| Protocol | Identifies the transport protocol, such as TCP or UDP. | Use it to distinguish connection-oriented TCP activity from connectionless UDP activity. |
| State | Shows the current TCP connection state when applicable. | Use it to understand the stage of a TCP connection. State information is primarily meaningful for TCP endpoints. |
| Local address | The IP address on the local computer used by the endpoint. | Shows which local interface or address is participating. A wildcard or broadly scoped address can indicate that the process is using more than one local interface. |
| Local port | The port number used by the local process. | Helps identify a service listening or communicating on the machine and can be correlated with other network records. |
| Remote address | The IP address or resolved host name of the other system in a network connection. | Identifies the peer with which the process is communicating. This field may not represent a single connected peer for every UDP usage. |
| Remote port | The port number used by the remote endpoint. | Helps identify the destination service or application endpoint. |
TCP and UDP in the List
TCP, or Transmission Control Protocol, is a connection-oriented transport protocol. A TCP row can include a connection state, which describes the current status of that session.
UDP, or User Datagram Protocol, is connectionless. UDP does not use the TCP connection lifecycle, so do not interpret a UDP row as having a TCP-style state progression. Depending on how the endpoint is used, its remote address or remote port may not identify a continuously connected peer.
Understanding TCP Connection States
ESTABLISHED means that a TCP connection has been successfully formed and is capable of exchanging data. When you see a TCP row with this state, read the local address and local port as one side of the session and the remote address and remote port as the connected peer.
State information is primarily meaningful for connection-oriented TCP endpoints. It should not be used to judge UDP activity because UDP does not establish a TCP-style session.
Example: Inspecting an Active TCP Session
- Select a process that is currently communicating over the network.
- Open its Properties window and select the TCP/IP tab.
- Find a row whose protocol is TCP and whose state is ESTABLISHED.
- Read the local address and local port to identify the local side of the session.
- Read the remote address and remote port to identify the connected peer.
For example, a row with a local address and port followed by a remote host and port describes the process's side of that TCP session and the system receiving or sending the other side of the communication. The exact values depend on the process and the activity occurring at inspection time.
DNS Name Resolution
Process Explorer resolves IP addresses to DNS names by default when names can be resolved. A resolved host name can be easier to recognize than a numeric address, especially when the name identifies a known service, server, or organization.
The Resolve addresses option controls this display. Clear the option to show numeric IP addresses instead of resolved DNS names.
| Display mode | What is shown | Best use case |
|---|---|---|
| Resolve addresses enabled | DNS-resolved host names when resolution succeeds. | Quickly recognizing familiar systems and making endpoint lists easier to read. |
| Resolve addresses disabled | Numeric IP addresses. | Exact network troubleshooting, verification, correlation with firewall or network logs, and cases where DNS resolution is misleading or unavailable. |
Example: Displaying Numeric IP Addresses
- Open the TCP/IP tab for a process with listed endpoints.
- Note an endpoint currently shown with a host name.
- Clear the Resolve addresses option.
- Review the row again and use the numeric address for exact diagnosis or log correlation.
Name resolution is a convenience, not proof of identity. A displayed host name can depend on DNS configuration and may be unavailable, delayed, or misleading. For verification, compare the numeric address with trusted network records.
Using the Tab During an Investigation
Associate Activity with a Process
Select a suspected or unfamiliar process and review its TCP and UDP rows. The protocol, local port, and remote endpoint fields help determine what network activity is attributable to that process. This is particularly useful when several applications are active at the same time.
Use Local Ports to Identify Services
A local port shows which port the process uses. A process that listens for incoming traffic may use a stable service port, while a client application often uses a temporary local port for outbound communication. Treat the port as a clue: multiple applications can use different ports, and port numbers alone do not establish what a program is doing.
Use Remote Endpoints to Identify Peers
The remote address and remote port help identify the systems and services with which a TCP process communicates. Use resolved names for quick recognition or numeric addresses when matching the activity against firewall events, packet captures, DNS records, or other logs.
Troubleshooting Common Questions
A Host Name Is Shown, but I Need the Exact IP Address
Clear Resolve addresses on the TCP/IP tab. The endpoint should then be displayed with a numeric IP address, which can be compared directly with network logs and diagnostic results.
The Process Has Network Activity, but I Cannot Identify the Connection
Open that process's Properties window and inspect its TCP/IP tab. Compare the protocol, local port, local address, remote address, and remote port for each row. A process can have several endpoints, and TCP and UDP entries must be interpreted differently.
I See ESTABLISHED and Do Not Know What It Means
ESTABLISHED indicates a currently formed TCP connection that is capable of exchanging data. It does not, by itself, describe whether the data is expected or trustworthy.
No Expected Connection Appears
Verify that the process is actively using the network at the time of inspection. The endpoint list can change quickly. Also check whether the expected activity uses UDP rather than TCP; UDP endpoints do not use TCP connection states.
Exam-Relevant Notes
- The TCP/IP tab is located in a selected process's Properties window.
- It shows active TCP and UDP endpoints associated with that process.
- Protocol distinguishes TCP from UDP.
- TCP has connection states; UDP does not have a TCP-style connection lifecycle.
- ESTABLISHED means a TCP session has been successfully formed and can exchange data.
- Local address and local port describe the process's side of the communication.
- Remote address and remote port describe the peer side of a connection.
- Process Explorer resolves addresses to DNS names by default when possible.
- Clear Resolve addresses to display numeric IP addresses.
- An endpoint listing is evidence of association, not a final determination of whether activity is benign or malicious.