How to Get Open TCP and UDP Ports in Batch Script

@echo off
setlocal

echo [PORT AUDIT] Scanning active TCP/UDP ports...
echo.

:: -a = All ports
:: -n = Numerical form (faster, doesn't resolve hostnames)
:: -o = Include the Process ID (PID)

echo === LISTENING TCP PORTS ===
echo.
echo PROTO  LOCAL ADDRESS          STATE          PID
echo --------------------------------------------------
netstat -ano | findstr "LISTENING"
echo --------------------------------------------------

echo.
echo === ACTIVE UDP PORTS ===
echo.
echo PROTO  LOCAL ADDRESS          PID
echo --------------------------------------------------
netstat -ano | findstr "^  UDP"
echo --------------------------------------------------

pause
endlocal

@echo off
setlocal

set "TargetPort=3389"
set "TempFile=%TEMP%\port_check.tmp"

echo [SCAN] Checking for activity on port %TargetPort%...
echo.

:: Use word boundary matching with \b to avoid false positives
:: e.g., searching for :80 would also match :8080, :800, :8000
:: Capture to temp file so we can both display and check the result
netstat -ano | findstr /R ":%TargetPort%[^0-9]" > "%TempFile%" 2>&1

:: Check if anything was found (findstr sets errorlevel BEFORE the pipe, not after)
:: Instead, check if the temp file has content
for %%F in ("%TempFile%") do set "FileSize=%%~zF"

if %FileSize% gtr 0 (
    echo [FOUND] Port %TargetPort% is active:
    echo.
    type "%TempFile%"
) else (
    echo [INFO] Port %TargetPort% is not currently in use.
)

:: Clean up
del "%TempFile%" >nul 2>&1

pause
endlocal

@echo off
setlocal enabledelayedexpansion

echo [REPORT] Mapping Listening Ports to Applications...
echo.
echo ADDRESS:PORT                        PID        PROCESS NAME
echo =================================================================

:: Track seen PIDs to avoid duplicate tasklist lookups
set "seen_pids="

for /f "tokens=2,5" %%a in ('netstat -ano ^| findstr "LISTENING"') do (
    set "addr=%%a"
    set "pid=%%b"

    :: Skip if PID is 0 (System Idle) or empty
    if "!pid!" neq "0" if defined pid (
        :: Look up the process name for this PID
        for /f "tokens=1" %%n in ('tasklist /fi "pid eq !pid!" /fo table /nh 2^>nul ^| findstr /v "INFO:"') do (
            rem Dynamically pad the address up to 36 spaces for a perfect visual column
            set "padAddr=!addr!                                        "
            set "padAddr=!padAddr:~0,36!"
            
            rem Dynamically pad the PID up to 11 spaces
            set "padPid=!pid!           "
            set "padPid=!padPid:~0,11!"
            
            echo !padAddr!!padPid!%%n
        )
    )
)

echo ================================================================
echo.
echo [TIP] Run as Administrator to see protected system service names.

pause
endlocal

@echo off
setlocal

:: Generate a timestamp for the filename
for /f "tokens=2 delims==" %%a in ('wmic os get localdatetime /value 2^>nul') do (
    for /f "delims=" %%b in ("%%a") do set "dt=%%b"
)
set "timestamp=%dt:~0,4%-%dt:~4,2%-%dt:~6,2%_%dt:~8,2%%dt:~10,2%%dt:~12,2%"

set "LogDir=%USERPROFILE%\PortAudits"
set "LogFile=%LogDir%\ports_%timestamp%.txt"

:: Create log directory if it doesn't exist
if not exist "%LogDir%" mkdir "%LogDir%"

echo [AUDIT] Saving full port snapshot to:
echo         %LogFile%
echo.

(
    echo ========================================
    echo  PORT AUDIT - %date% %time%
    echo  Computer: %COMPUTERNAME%
    echo ========================================
    echo.
    echo --- TCP PORTS ---
    echo   Proto  Local Address          Foreign Address        State           PID
    netstat -ano | findstr "TCP"
    echo.
    echo --- UDP PORTS ---
    echo   Proto  Local Address          Foreign Address        State           PID
    netstat -ano | findstr "UDP"
    echo.
    echo ========================================
) > "%LogFile%"

echo [OK] Snapshot saved. Compare with previous audits to detect changes.
echo.

:: If a previous audit exists, offer a quick comparison
set "PrevFile="
for /f "delims=" %%f in ('dir /b /o-d "%LogDir%\ports_*.txt" 2^>nul') do (
    if defined PrevFile goto :compare
    set "PrevFile=%%f"
    :: Skip the first file (it's the one we just created)
    set "PrevFile="
)
for /f "delims=" %%f in ('dir /b /o-d "%LogDir%\ports_*.txt" 2^>nul ^| more +1') do (
    set "PrevFile=%%f"
    goto :compare
)

:compare
if defined PrevFile (
    echo [INFO] Previous audit found: %PrevFile%
    echo [TIP]  Use "fc %LogFile% %LogDir%\%PrevFile%" to compare changes.
) else (
    echo [INFO] No previous audit found. This is your baseline.
)

pause
endlocal

:: TCP listening ports
netstat -ano | findstr "LISTENING"

:: UDP active ports
netstat -ano | findstr "^  UDP"

netstat -ano | findstr /R ":80[^0-9]"