To export listening ports to CSV on Windows, run Get-NetTCPConnection -State Listen in PowerShell, add the process name from Get-Process, and pipe the result to Export-Csv. That gives you a one-time snapshot. If you need the process path, UDP, and a record of what was listening over time, Port Detective Pro keeps a connection history timeline you can export to CSV or JSON. The free PowerShell route below is enough for a single audit.
People usually need this file for one of three reasons: a security or compliance review asks “what is listening on this machine?”, a helpdesk ticket needs evidence, or a developer wants a before and after record around an install.
Keep a timeline of what listened on which port, and export it when someone asks.
Get it from Microsoft
Why not just save netstat output?
netstat -ano > ports.txt works, but it is a text report, not data. The columns are padded with spaces, IPv6 addresses contain colons, and the process is only a PID. Microsoft’s netstat reference documents -b to show the executable, but that option needs elevated permissions and prints the name on a separate line, which breaks any simple import into Excel.
PowerShell returns objects with named properties, so the export is clean from the start.
How do I export TCP listening ports with PowerShell?
Microsoft documents Get-NetTCPConnection with a -State filter whose accepted values include Listen, and an OwningProcess property that holds the PID. Combine it with Get-Process to add the name and path:
Get-NetTCPConnection -State Listen |
Select-Object LocalAddress, LocalPort, OwningProcess,
@{Name='ProcessName'; Expression={(Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName}},
@{Name='Path'; Expression={(Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).Path}} |
Sort-Object LocalPort |
Export-Csv -Path "$env:USERPROFILE\Desktop\listening-ports.csv" -NoTypeInformationStep by step:
- Open PowerShell as administrator. Without elevation, the Path column is often blank for system and service processes.
- Paste the command and press Enter.
- Open the file from your desktop in Excel or any CSV viewer.
- Note the time. The file is a snapshot; ports opened a minute later are not in it.
About -NoTypeInformation: Microsoft’s Export-Csv documentation says it removes the #TYPE header line and “is not required in PowerShell 6” and later. In Windows PowerShell 5.1, which ships with Windows, keep it.
If your region uses a comma as the decimal separator and Excel expects semicolons, add -UseCulture, which Export-Csv documents for using the current culture’s list separator.
How do I include UDP ports?
UDP has no “listening” state, so it needs a second cmdlet. Microsoft documents Get-NetUDPEndpoint as returning UDP endpoint properties such as local ports. Append it to the same file:
Get-NetUDPEndpoint |
Select-Object LocalAddress, LocalPort, OwningProcess,
@{Name='ProcessName'; Expression={(Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName}} |
Export-Csv -Path "$env:USERPROFILE\Desktop\listening-ports-udp.csv" -NoTypeInformationKeep TCP and UDP in separate files, or add a Protocol column, so a reviewer does not confuse them.
What columns should a listening port export have?
For an audit or ticket, these columns answer the questions people actually ask:
| Column | Why it matters |
|---|---|
| Protocol | TCP and UDP have different risks and firewall rules |
| Local address | 0.0.0.0 or [::] can be reached from the network; 127.0.0.1 is local only |
| Local port | The number the reviewer will look up |
| PID | Lets you match the row to Task Manager at that moment |
| Process name | The quick human answer |
| Full path | Separates C:\Windows\System32\svchost.exe from a copy in a temp folder |
| Captured at | Ports change; a timestamp makes the file evidence rather than a guess |
| Note | Why the port is expected, such as “required by backup agent” |
The PowerShell example covers the first six. Add the time with a calculated property or in the file name, and the note by hand.
What are the limits of a PowerShell snapshot?
The script is free and good. It is also a single point in time, which matters more than people expect:
- Short-lived listeners are missed. A dev server or updater that opens a port for 30 seconds will not appear unless it is running at that moment.
- PIDs go stale. By the time someone reads the file, the PID may belong to a different program.
- svchost.exe hides services. The process name for many Windows listeners is svchost.exe. Run
tasklist /svcto see the hosted services. - It is one machine. Checking a VM or another server means running the script there too.
If you need the “what was listening yesterday at 3 pm” answer, you need history, not a snapshot.
Export a CSV or JSON timeline of listening ports instead of rerunning scripts.
Get it from Microsoft
How do I export listening ports with Port Detective?
Port Detective is a native Windows app that shows every listening port with its process name, PID, and full path, live. Port Detective Pro adds a connection history timeline, exportable to CSV or JSON. A typical audit flow:
- Install Port Detective Pro from the Microsoft Store and keep it running during the period you are auditing.
- Add per-port notes for the ports you expect, such as “445: scanner share” or “5432: local PostgreSQL”. Notes can be backed up and restored.
- Review the connection-history timeline. Because it is a timeline rather than a one-off snapshot, it can show changes that happened while Port Detective was running, which a single PowerShell export would miss.
- Export to CSV or JSON and attach it to the ticket or audit record.
- Check remote machines with remote scans (VMs, Docker bridges, servers, with presets and ranges) from the same window.
Pro covers TCP and UDP for IPv4 and IPv6, and its privilege-aware interface flags protected OS processes so a reviewer can see which rows are core Windows. Port Detective has no telemetry, so the export stays on your PC until you share it.
What it is not: an inventory or SIEM system for a fleet. If you need listening ports from hundreds of PCs, use your endpoint management tooling.
Which method should I use?
| Need | Best fit |
|---|---|
| One-time snapshot of one PC | PowerShell (free, built in) |
| Snapshot including UDP | PowerShell with Get-NetUDPEndpoint |
| Record over hours or days | Port Detective Pro history timeline |
| Same view for a VM or server | Port Detective Pro remote scans, or run the script there |
| Hundreds of machines | Your endpoint management or security platform |
For background on reading the results, see our listening port audit and the netstat guide for developers.
Frequently asked questions
Can I export netstat -ano directly to CSV?
Not cleanly. netstat output is fixed-width text. Use Get-NetTCPConnection, which returns objects that Export-Csv can write as proper columns.
Why is the Path column empty for some processes?
Reading another account’s process details needs elevation. Run PowerShell as administrator. Some protected processes may still not report a path.
Does Port Detective export to Excel?
It exports CSV and JSON, and CSV opens directly in Excel.
Is the free edition enough for an audit?
The free edition shows the live list with process names and paths. History export, UDP, and remote scans are in Pro.
Try Port Detective
Get the free edition from the Microsoft Store, or buy Port Detective Pro once for history export, UDP, and remote scans. See the Port Detective product page for the full feature list.
Answer “what is listening on this machine?” with a file you can attach.
Get it from Microsoft
Microsoft, Windows, PowerShell, and Excel are trademarks of the Microsoft group of companies. Other product names are trademarks of their owners. Port Detective is not affiliated with or endorsed by any of them.
Last updated 17 October 2026. Published by Automata Labs, a software company in Canada.