Process & Port Analyzer – Network & Process Monitor for Windows
A free Windows utility for deep inspection of running processes, active TCP/UDP connections, listening ports, Windows Firewall rules, and live packet capture — all using native Windows APIs, no third-party libraries required.
Download Desktop/Server Version 3.3
Free on the Microsoft Store — no subscription, no ads.
Features
⚙️ Running Process Viewer
Lists all running processes with PID, process name, and full executable file path. Double-click any process to open a detailed module view showing every DLL and file loaded by that process — with its full path, whether it is signed, its company and version, and unsigned files tinted red.
🔌 Active TCP/UDP Connections
Displays all active TCP and UDP connections, IPv4 and IPv6, in real time — showing PID, protocol, local IP/port, remote IP/port, connection state (e.g. ESTABLISHED, TIME-WAIT), process name, and full executable path.
👂 Listening Ports Viewer
Shows all TCP and UDP ports currently in a listening state, over IPv4 and IPv6, including the owning PID, process name, and full file path — making it easy to identify which services are accepting inbound connections.
📡 Packet Sniffer
Built-in raw packet sniffer using native Winsock APIs in promiscuous mode. Captures and decodes TCP, UDP, ICMP, and IGMP packets — showing protocol, source/destination IP and port, packet size, TTL, and TCP flags (SYN, ACK, FIN, RST, etc.).
🔎 Packet Filtering
Filter captured packets by source IP, destination IP, source port, and destination port. Only matching traffic is displayed — making it easy to isolate specific connections in a busy network.
💾 Packet Hex Dump
Optionally save captured packets to a dump.log file with timestamped entries showing protocol, source/destination, packet size, and a full hex + ASCII side-by-side dump of each packet's raw content.
🛡️ Windows Firewall Rule Manager
View, create, enable, and disable Windows Firewall rules directly from the app. Create inbound, outbound or both-direction rules for TCP, UDP, ICMP, or any protocol, with specific local/remote IPs and ports, a specific program, and the Domain / Private / Public profiles they apply to — or block a connection with one right-click.
🚫 Block a Connection, Port or Program
Right-click any active connection and choose "Block this connection" to open the firewall rule creator pre-filled with the connection's IP, port and protocol. Or choose Block program's network access… on any process, listener or connection to cut that program off on every port, in both directions, in a couple of clicks.
🔃 Sortable Columns
All list views support column sorting — click any column header to sort ascending or descending. Numeric columns (like PID and port numbers) sort as integers, not text, for accurate ordering.
🔒 No External Dependencies
Everything runs on native Windows APIs — iphlpapi, psapi, Winsock2, and the Windows Firewall COM interface. No WinPcap, Npcap, or any third-party library required.
🚩 Suspicious-Process Detection
A Risk column flags processes as High or Medium using local, offline heuristics — unsigned binaries, system-name masquerading, running from temporary folders, self-deleted executables, sideloading, suspicious parent/child chains, command lines that leave nothing on disk, and risky network behaviour. Select a flagged row to see exactly why it was raised, or tick Flagged only to see just those. Signatures are checked the way Windows checks them, so built-in programs aren’t mistaken for unsigned ones — a typical machine shows one or two flags, not twenty. These are signals, not verdicts: plenty of legitimate software trips one. Everything is computed on your own machine.
⚡ One-Click Row Actions
Every row on Processes, Listening and Connections ends with action icons that mirror the right-click menu — build a full plain-text process report to paste into an AI assistant, block the port or connection, show the loaded modules, or end the process after a confirmation. Select several rows and End process ends all of them, listing exactly what will be closed.
🌍 Host Names & Locations
Right-click a connection and Resolve host name to look up the remote address’s DNS name. Optionally tick Geo-locate to fill in each remote address’s country and city. This is the only feature that sends anything off your machine — just the addresses you are connected to, to a lookup service. It is off by default and asks before the first use.
💾 It Remembers Your View
The tab you were on, the Processes filters, the protocol and state filters, column sort and column widths, and your auto-refresh interval are all restored the next time you open the app. Auto-refresh keeps your selected rows and scroll position, pauses while a dialog is open, and no longer re-runs the risk scan on every tick.
Common Uses
🕵️ Security Auditing
Identify unexpected outbound connections, suspicious listening ports, or unknown processes communicating on your network — without needing any external tools.
🖥️ Server Monitoring
Get a full picture of what's running and listening on a Windows server — ideal for system administrators checking service health or investigating unexpected activity.
🧑💻 Developer Network Debugging
Trace which ports your application is using, inspect raw TCP/UDP packets during development, and verify your app's network behaviour with the built-in packet capture and hex dump.
🔥 Firewall Troubleshooting
View all existing Windows Firewall rules in one place, enable or disable rules on the fly, and quickly create precise block or allow rules based on live connection data.
Screenshots
Running Processes
Listening Ports
Active TCP/UDP Connections
Firewall Rule Manager
Latest Release
Version 3.3 — October 15, 2026
IPv6 listeners and connections now appear alongside IPv4. Block a program’s network access from any row, with rules that can cover both directions, a specific program and chosen network profiles. A “Flagged only” filter and a panel that explains each flag — and far fewer false flags, since signatures are now checked the way Windows checks them. The Modules window shows each DLL’s signature, company and version. Plus a sniffer that stays responsive under heavy traffic, standard connection-state names with every state in the filter, and CSV exports that are safe to open in Excel.