How to Audit Per-Process Network Bandwidth on Windows and Linux
Track down hidden network hogs, cloud sync daemons, and unexplained telemetry spikes with Resource Monitor, PowerShell NetTCPConnection, Linux nethogs, and NetSniffer.
Detecting Hidden TCP/UDP Sockets and Ghost Network Connections
How to track listening ports, orphaned socket handles, and hidden background network connections on Windows and Linux workstations.
Why Ghost Network Sockets Matter
Every open TCP or UDP socket represents an allocated kernel buffer and a potential entry/exit vector on your local network.
Common issues caused by hidden socket bindings:
1. Port Conflicts: Developing locally and finding port 3000, 8080, or 5432 blocked by an orphaned node or postgres worker.
2. Ephemeral Port Exhaustion: Poorly written background sync agents failing to reuse sockets, accumulating thousands of connections in TIME_WAIT or CLOSE_WAIT.
3. Undocumented Inbound Listeners: Background updater daemons opening universal listening ports across 0.0.0.0 without user awareness.
---
Method 1: Finding Port Bindings via PowerShell
To inspect every listening socket and immediately resolve the executable name:
powershell
Get-NetTCPConnection -State Listen | ForEach-Object {
$proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
[PSCustomObject]@{
Port = $_.LocalPort
BindAddress = $_.LocalAddress
PID = $_.OwningProcess
Process = $proc.ProcessName
Path = $proc.Path
}
} | Sort-Object Port | Format-Table -AutoSize
---
Method 2: Linux CLI via `ss`
To inspect listening sockets on Linux:
bash
# List all TCP/UDP listeners with process info
sudo ss -tulpn
To filter specifically for listening sockets on a specific port (e.g. port 8080):
bash
sudo ss -tulpn | grep ':8080'
---
Method 3: Visual Socket Mapping with NetSniffer
If you need a continuous, real-time visual interface: * NetSniffer maps all active local sockets to their respective PIDs. * Flags suspicious non-standard port bindings and foreign endpoint IP locations. * Single-binary, lightweight execution without packet capture drivers.
Frequently Asked Technical Questions
The TIME_WAIT state is part of the standard TCP state machine. When an endpoint closes a connection, it waits for 2 MSL (Maximum Segment Lifetime, typically 60–120 seconds) to ensure delayed packets don't collide with subsequent connections on the same ephemeral port.
Elena Rostova
Network Security & Protocols Engineer
Focuses on local packet capture, socket lifecycle analysis, telemetry auditing, and privacy-preserving networking tools.
Focus:Socket InspectionPacket InspectionDNS DiagnosticsApplication Telemetry Auditing
Related Systems Guides
View all guides →Auditing Windows Application Telemetry and Background Network Connections
Learn how modern desktop software bundles analytics SDKs, how to capture background telemetry requests locally, and how to verify software privacy without running shady de-bloat scripts.
Read Guide
Why Lightweight Micro-Utilities Outperform Monolithic System Suites
From excessive RAM consumption to bundled telemetry and kernel-level instability, monolithic software suites slow down the very machines they claim to optimize. Here is the engineering case for the anti-bloat micro-utility model.