PowerShell: Trace a TCP Connection to Its Process
Find established HTTPS connections, select one owning PID, and identify the process object behind it. Work through it yourself in the live host terminal below.
Symptom
Find established HTTPS connections, select one owning PID, and identify the process object behind it.
Your mission
Inspect, recover, then verify
Format
Windows PowerShell
Investigate before you configure.
Use the CLI evidence to isolate the fault, make the smallest safe correction, then verify the network state changed.
Observe the symptom and link state.
Diagnose by comparing the protocol evidence.
Verify the expected device state and confirm the original symptom is resolved.
Console access: PowerShell
This workspace stacks for portrait phones. Rotate to landscape for the full split-screen console.
Need a hint?
Reveal the root cause when you're ready.
Try the investigation first, then use this as your escape hatch, not a dead end.
Lab debrief
Turn the session into a repeatable troubleshooting pattern.
Use this reference after your attempt: first explain the symptom, then verify the evidence, then confirm the repair.
The problem
A workstation maintains an unexpected established connection to 203.0.113.60 on TCP 443.
What you'll practice
- Filter TCP connections by state and remote port
- Read local and remote endpoint properties
- Use OwningProcess safely
- Resolve a PID with Get-Process
The topology
One Windows workstation has normal browser traffic plus an unexpected HTTPS connection from a background updater.
Commands to run yourself
The real diagnostic commands for this lab, copy-paste ready. Run these in the same order to reproduce the investigation on your own session.
Get-NetTCPConnection -State Established -RemotePort 443Topology diagram
Fact-checked references
The commands and behaviour in this lab were checked against these primary references.
Frequently asked
Does an established connection mean malware?
No. It proves a TCP session exists. Attribution, expected behavior, signatures, and organizational context are needed before deciding it is malicious.
Can multiple connections share one PID?
Yes. One process can own many sockets and connections.
Ready to run this lab yourself?
No setup, no image sourcing. Book a session or ask for a live demo.