Most of the listening ports you see on a clean Windows PC belong to Windows itself: 135 is the RPC endpoint mapper, 137 to 139 and 445 are file and printer sharing, 1900 and 2869 are device discovery, 3389 is Remote Desktop, and 5985 or 5986 is Windows Remote Management. Port Detective lists every listening port with its process name, PID, and path, so you can separate these built-in listeners from the ones an app added. The table below maps each common port to the service Microsoft documents for it.
If you have ever run netstat -ano and wondered why a PC you only use for email has a dozen open ports, this is for you.
See every listening port with the process and path behind it, in one window.
Get it from Microsoft
Which ports does Windows itself listen on?
Microsoft maintains a long reference called Service overview and network port requirements for Windows. It is written for administrators who configure firewalls, and it lists which ports each Windows service uses. These are the ones you are most likely to see on a desktop or laptop:
| Port | Protocol | Windows service (service name) | What it does |
|---|---|---|---|
| 135 | TCP | Remote Procedure Call (RpcSs) | RPC endpoint mapper; many services depend on it |
| 137 | UDP | Server (lanmanserver) and others | NetBIOS name resolution |
| 138 | UDP | Server (lanmanserver) | NetBIOS datagram service |
| 139 | TCP | Server (lanmanserver) | NetBIOS session service, older file sharing |
| 445 | TCP | Server (lanmanserver) | SMB file and printer sharing |
| 1900 | UDP | SSDP Discovery (SSDPRSR) | Discovery of network devices |
| 2869 | TCP | SSDP Discovery and UPnP Device Host (UPNPHost) | Device event notification and hosting |
| 3389 | TCP and UDP | Remote Desktop Services (TermService) | Incoming Remote Desktop connections |
| 5985 | TCP | Windows Remote Management (WinRM) | WinRM 2.0 over HTTP |
| 5986 | TCP | Windows Remote Management (WinRM) | WinRM 2.0 over HTTPS |
| 49152 to 65535 | TCP | Many services | The default dynamic port range |
Two notes from the same Microsoft document are worth knowing. First, the NetBIOS ports (137, 138, 139) are listed as optional: “Windows 2000 and newer clients can work over port 445.” Second, SSDP event notification used TCP 5000 on very old systems, but “starting with Windows XP Service Pack 2 (SP2), the SSDP event notification service uses TCP port 2869.”
Not every PC listens on all of these. Remote Desktop only listens when incoming connections are turned on, WinRM only when it has been configured, and sharing ports depend on your network profile and sharing settings.
Why does a port show the owner as svchost.exe or System?
Many of these services do not run as their own .exe. They run inside a shared host process, svchost.exe, and netstat shows that host’s PID rather than the service name. Two practical consequences:
- Several services can share one PID. Ending that PID ends all of them, which is rarely what you want.
- The name tells you little. You need the service name, not the process name, to decide what to do.
To map a svchost PID to its services, run tasklist /svc /fi "PID eq 1234" (replace 1234 with the PID). The output lists each service hosted in that process.
Some listeners report PID 4, the System process. That usually means a kernel component is the listener, for example the Windows HTTP stack on 80 and 443. Our guide to port 80 in use by System PID 4 covers the HTTP case.
What do 0.0.0.0, 127.0.0.1 and [::] mean in the address column?
The local address column tells you who can reach the listener:
| Local address | Reachable from | Typical example |
|---|---|---|
| 0.0.0.0:445 | Any IPv4 interface, including the network | File sharing |
| [::]:445 | Any IPv6 interface | The IPv6 side of the same listener |
| 127.0.0.1:3000 | This PC only (loopback) | A local dev server |
| 192.168.1.20:2869 | Only that one network adapter | A service bound to your LAN address |
A listener on 0.0.0.0 is not automatically exposed to the internet. Windows Firewall and your router decide what actually gets in. But a listener on 0.0.0.0 is the first thing to review if you are auditing a machine.
Which listening ports should I investigate?
Use the built-in list as your baseline and look harder at anything outside it. A simple way to triage:
- Get the full list. Run
netstat -anoand look at lines with LISTENING (TCP) plus the UDP section, or open Port Detective and read the list with process names and paths. - Match the known Windows ports. Anything in the table above, owned by svchost.exe or System, is very likely the documented service.
- Check the path of everything else. An app in
C:\Program Filesthat you installed on purpose (a database, Docker, a sync client) is expected. A process in a temp or user downloads folder is not. - Look at the address. Prefer loopback-only listeners for local tools. A dev tool that listens on 0.0.0.0 may be reachable from your network.
- Decide per port. Turn the feature off in Settings, uninstall the app, or leave it if it is needed.
For a fuller checklist, see our page on auditing an unexpected listening port. For the two ports helpdesks ask about most, see what is on port 3389 and 445 and the SMB port 445 review.
Read the owner, PID, and full path of every listener without parsing netstat output.
Get it from Microsoft
Should I close these ports?
Usually not by ending processes. Built-in listeners are controlled by settings and services:
| Port | Safe way to turn it off | What you lose |
|---|---|---|
| 3389 | Settings, System, Remote Desktop, turn it off | Incoming Remote Desktop |
| 445 and 139 | Turn off file and printer sharing for the network profile | Sharing folders and printers from this PC |
| 1900 and 2869 | Turn off network discovery for the profile | Seeing and being seen by devices on the LAN |
| 5985 and 5986 | Remove the WinRM listener if you configured one | Remote PowerShell management |
| 135 | Do not disable | Many services depend on RPC to start |
Microsoft’s reference says plainly that “many services depend on the RPC service to start successfully,” which is why 135 is the one you leave alone.
On managed work PCs, ask IT before changing any of this. These ports are often required by management tools.
How does Port Detective help with a listening port audit?
Port Detective is a native Windows app written in Rust that lists every listening port with the process name, PID, and executable path, and lets you search by port instantly. It typically uses under 50 MB of RAM and sends no telemetry.
For an audit, the features that matter are:
- Process path next to every port, so you can tell
C:\Windows\System32\svchost.exefrom a copy running somewhere else. - Protected process flags, so System and core services are marked and you are not tempted to end them.
- TCP and UDP for IPv4 and IPv6 (Pro), so the UDP discovery ports and IPv6 listeners are not missed.
- Connection history timeline (Pro), exportable to CSV or JSON, so you can show what was listening and when.
- Remote scans (Pro), so you can check a VM, a Docker bridge, or a server from the same window.
- Per-port notes (Pro), so you can record “445: needed for the scanner share” and back the notes up.
What it is not: a firewall or an intrusion detection system. It tells you who is listening. Windows Firewall and your security tools decide who can connect.
Frequently asked questions
Is port 135 open a security risk?
Port 135 is the RPC endpoint mapper, and many Windows services depend on it. It should be blocked from untrusted networks by your firewall, not disabled on the PC.
Why is port 445 listening on my home PC?
445 is SMB, used for file and printer sharing by the Server service. It listens when sharing features are available. If you never share files from this PC, you can turn off file and printer sharing for your network profile.
What is port 2869?
Microsoft lists TCP 2869 for SSDP event notification and for the UPnP Device Host service, both used for discovering and hosting network devices.
What are all the high ports like 49668?
Windows hands out ports from the dynamic range, 49152 to 65535 on Windows Vista and later, to services that ask for any free port. RPC-based services often listen there.
Can Port Detective show which service is inside svchost.exe?
Port Detective shows the svchost.exe process, PID, and path. To see the individual services in that host, use tasklist /svc with the PID, or Services in Task Manager.
Try Port Detective
Get the free edition from the Microsoft Store, or buy Port Detective Pro once for TCP and UDP coverage, history, and remote scans. More on the Port Detective product page, or see how to find what process is using a port.
Know every listener on your PC, and which ones you can safely stop.
Get it from Microsoft
Microsoft, Windows, and Remote Desktop are trademarks of the Microsoft group of companies. Other product names are trademarks of their owners. Port Detective is not affiliated with or endorsed by any of them.
Last updated 17 October 2026. Published by Automata Labs, a software company in Canada.