How to monitor network connections on Windows 11
See how to inspect active Windows network connections and why process attribution and security context matter when investigating unexpected traffic.
Windows already exposes connection data
Windows includes tools for inspecting network activity. Task Manager can show network usage, while the netstat command can display active TCP connections and listening ports. With appropriate options, netstat can also show numeric addresses and the process ID associated with a connection.
The hard part is understanding what a connection means
An unfamiliar remote address is not automatically malicious. A useful investigation asks which process owns the connection, whether the process is expected, whether the connection is inbound or outbound, and what other system evidence was present at the same time.
Sentinel AI’s role
Sentinel AI’s security workflow includes incoming and outgoing network telemetry and process attribution. Its purpose is to bring network evidence into the same investigation context as processes, services, startup behavior, firewall state, and other verified system evidence.
Where Sentinel AI fits
Sentinel AI is a Windows security suite built around continuous monitoring, investigation, evidence correlation, containment, quarantine, remediation, optimization, and clear guidance. It works alongside Microsoft Defender rather than replacing the antivirus engine. Defender remains responsible for antivirus and antimalware scanning; Sentinel adds the broader investigation and response workflow around Windows system and security evidence.
View Sentinel AI in Microsoft Store
Frequently asked questions
What Windows command shows active TCP connections?
The built-in netstat command can display active TCP connections and listening ports. Options can add numeric addresses and process IDs.
Is every unknown network connection dangerous?
No. Many legitimate Windows components and applications communicate with remote services. Investigate the owning process and surrounding evidence before drawing a conclusion.
Does Sentinel AI replace Windows Firewall?
No. Sentinel AI integrates Windows firewall evidence and can support verified containment workflows; Windows Firewall remains the underlying Windows firewall technology.
Last reviewed: September 6, 2026.