Display all TCP and UDP network activity on Windows

Martin Brinkmann
Apr 20, 2018

LiveTcpUdpWatch is a free software program by Nirsoft that displays information about the TCP and UDP activity of any Windows device it is run on.

Windows comes with a handful of tools that reveal network activity; you may open the network tab of the Resource Monitor, or use the command line tool netstat to display open network connections using netstat -an (also available for Linux).

LiveTcpUdpWatch is a portable program for Windows that displays live network activity. You may run the program from any location on Windows systems as it does not need to be installed and can be run right away.

The application is compatible with Windows XP and newer versions of Windows, and is provided as a 32-bit or 64-bit executable.


live tcp upd watch

LiveTcpUdpWatch updates the network activity list automatically after you start the program. It lists detailed information about each network connection in its interface including the local program name and process ID, protocol, IP addresses and ports, remote IP address and domain name (if available), and sent and received bytes.

The network data is updated in realtime with new network connections added to the end of the table. You may tap on the F2 key to toggle the recording of the activity; useful if a lot of new connections are added and you need to look at some connections in detail.

The program captures TCP, UDP, IPv4 and IPv6 network data by default. A click on the Options menu at the top displays the capturing options and gives you control over them so that you may disable those that you don't require.

You find other customization options there as well: use it to have the program remove closed TCP connections automatically, auto-scroll to the newest entries, or hide localhost connections automatically.

The program comes with the usual options that all Nirsoft programs come with. You may generate HTML reports or export some or all of the data to several file formats including XML and CSV.

Nirsoft published similar tools in the past, specifically CurrPorts and NetworkTrafficView. CurrPorts displays active TCP connections and listening ports; it is an excellent program but it won't show some data, for instance when UDP packets are sent from the local computer to a remote address.

NetworkTrafficView is a network sniffer that catpures network traffic and displays summaries of that traffic in its interface.

Closing Words

LiveTcpUdpWatch is another handy program for Windows users and administrators. It is lightweight and portable, and works exactly as advertised. You may use it to display all TCP and UDP connections a Windows machine makes. The data may be useful to find data leaks, programs that phone home, or other network activity on the system; even if malicious actors download data from your PC to a remote address.

Now You: Do you monitor your network traffic?

Related articles

software image
Author Rating
5 based on 3 votes
Software Name
Operating System
Software Category
Landing Page

Tutorials & Tips

Previous Post: «
Next Post: «


  1. Anonymous said on April 23, 2018 at 6:30 pm

    Sure looks like a clone or outright copy of TCPView.exe thats been available in MS’s Sysinternals Suite since about the Windows 2000 days.

    1. yourkindaintwelcomeroundhereboy said on April 23, 2018 at 11:05 pm

      Uh.. Nirsoft has exist since 2001, is famously known for utilities with very minimal interfaces and the strikingly similar interface is likely due to the fact it uses the same api’s that TCPview does. Shocking!

  2. Donuts :) said on April 21, 2018 at 10:54 pm

    Processhacker, they were previously on Sourceforge but have moved to Github.
    The program does a bit more than just watching network traffic.


  3. Dave said on April 21, 2018 at 4:54 pm

    TcpView does the same thing. The Sysintertnals Suite has about every tool you can imagine.

    I don’t know why people keep “reinventing the wheel”. Perhaps to make it look shinier?

    1. George said on April 22, 2018 at 12:36 pm

      Not really, this one offers more options. Perhaps you should wonder why people keep posting negative, aggressive comments for no apparent reason.

  4. Arthur said on April 21, 2018 at 12:48 am

    This is what the Internet was all about, bright people sharing amazing things with other like-minded people. I miss it.

    1. yourkindaintwelcomeroundhereboy said on April 23, 2018 at 10:56 pm

      >I miss it.

      Right? Remember when the internet was only what nerds used? I miss those days.

      Post-Smart phone days really fucked things up!

  5. dark said on April 20, 2018 at 10:41 pm

    What does the tool shows about Windows 10 telemetry/spying?

  6. Anonymous said on April 20, 2018 at 5:03 pm

    You can already do this with Resource Monitor

    1. yourkindaintwelcomeroundhereboy said on April 23, 2018 at 10:53 pm

      Process Hacker broseph.

    2. Anonymous said on April 21, 2018 at 11:48 am

      Resource Monitor only show TCP connection, not UDP

  7. camelon said on April 20, 2018 at 4:41 pm

    i like this tool than currport,
    but there is no filter

  8. HW said on April 20, 2018 at 4:15 pm

    What’s the interet if you cant close the connexion ?
    I use Nsauditor Network Security Auditor.

  9. George said on April 20, 2018 at 11:07 am

    Very nice tool. I’m missing an option to group/merge all processes/connections (of the same name, I mean).

  10. happysurf said on April 20, 2018 at 10:32 am

    Very useful tool.
    Thanks Martin.

  11. Andy said on April 20, 2018 at 10:12 am

    Nirsoft makes so many great little handy tools.

Leave a Reply

Check the box to consent to your data being stored in line with the guidelines set out in our privacy policy

We love comments and welcome thoughtful and civilized discussion. Rudeness and personal attacks will not be tolerated. Please stay on-topic.
Please note that your comment may not appear immediately after you post it.