Ghost Processes: See What Your Computer Is Really Doing

Do you ever find yourself looking at Task manager puzzled trying to find what is using all that precious RAM in my PC and can't find it? Do you perhaps have a local server running that you don't know about?

read the backstory

It has happened to me quite a few times. I was working on a web dev project with Node Server in cli on my text editor (VSCode). After I was done I simply closed VSCode and went about my day. Later I notice my RAM usage has significantly shot up. I open up my task manger to see no suspicious apps running. Chrome and Microsoft had taken majority of it but it was nothing out of the ordinary. This goes away if I restart the computer but I wanted to know the bug.
A few hours later, I resume my work on web project and run the 'npm run dev' command in terminal as you'd usually do -- I see localhost:3001.

What happened to my trusty localhost:3000? the server never actually stopped. So now I find ways to search and terminate this ghost process.

You can use this command in Administrator Powershell (or terminal of your choice on Win, Linux and macOS) to find all TCP ports listening. When you run this command, the output describes a "listening" socket that is a process waiting for incoming network connections.

netstat -abno | findstr LISTENING

It's output looks like this in a tabular format -

Protocol	Local Address	Foreign Address	State	PID
TCP	0.0.0.0:5501	0.0.0.0:0	LISTENING	95512
TCP	127.0.0.1:17400	0.0.0.0:0	LISTENING	6072
TCP	[::]:49666	[::]:0	LISTENING	3312

... ... ...

What this command means

netstat Is the Command
-a Displays all connections and listening ports.
-b Displays the executable involved in creating each connection or listening port. In some cases well-known executables host multiple independent components, and in these cases the sequence of components involved in creating the connection or listening port is displayed. In this case the executable name is in [] at the bottom, on top is the component it called, and so forth until TCP/IP was reached. Note that this option can be time-consuming and will fail unless you have sufficient permissions.
-n Displays addresses and port numbers in numerical form.

-o Displays the owning process ID associated with each connection which is important here.

In local address, you'll see the port number of your server, for example I'm running 5501. Note the Process Identifier or PID of the process. That’s what we’re after. For me it's 95512.

Once you have the PID, it’s just two quick commands to verify and kill it.

tasklist /fi "PID eq <PID>"

The command is used to identify exactly which Windows services are running inside a specific process.

What this command means

tasklist The command used to list processes.
/fi This parameter allows you to apply a filter to the output so you only see the tasks that match your specific criteria.
"PID eq <PID>": This is the specific filter condition.
- PID: Stands for Process Identifier, the unique number assigned to a running program.
- eq: An operator meaning equal to.
- <PID>: You replace this with the actual number you found (e.g., 95512

The output looks like this -

Image Name	PID	Session Name	Session#	Mem Usage
Code.exe	95512	Console	1	3,44,992 K

Now we have confirmed that this the process we need to kill, we go ahead and use taskkill.

taskkill /PID 95512 /F

This command is the "force quit" for Windows. It tells the operating system to immediately stop a specific program from running.

What does this command mean

taskkill The main command used to end one or more running processes.
/PID Again, Process Identifier. it tells the command that the next value (95512) is the unique ID number of the program you want to kill.
95512 This is the placeholder for the specific ID number you found using your previous netstat and tasklist commands.
/F This stands for Force. It tells Windows to terminate the process instantly without asking the program to save data or "close gracefully." It is used when a program is frozen or refusing to close.

⚠

Caution: Using /F on system processes can cause your computer to blue screen or restart instantly.

And that is it, you successfully stopped a rogue process from eating your system processes. You can always use npx kill-port 3000 to terminate as well instead of this flow. But then you'll not see several processes that also run on your PC.

Full flow in one glance

netstat -ano | findstr :PORT
Note the PID
tasklist /fi "PID eq <PID>"
Confirm it's node.exe
taskkill /PID PID /F
Re-run netstat to confirm the port is free.

Uses

You’d be surprised how often this comes in handy:

For everyday users:

When your internet feels unusually slow and something might be using it in the background
When your laptop fan is running loudly even though you’re not doing much
When an app doesn’t fully close and your system still feels sluggish
When you get errors like “this app is already running”
When an installer or update gets stuck and won’t restart properly
When you want to check for unknown or suspicious background activity

For developers:

When a port is already in use and your app won’t start
When a dev server keeps running even after closing your editor
When multiple instances of the same app are running and causing conflicts
When debugging strange backend behavior or unexpected responses
When working with containers or local environments that don’t shut down cleanly

Author's note

Thank you for reading this far! I'll make more of these if I see the demand and need for digital literacy and people ask how to use a computer proactively.

We are at a point that computers in our pockets have the capacity to run billions of operations and hundreds of processes a second. Remember, computers were made by engineers far more intellectual than the current average man. They were used for scientific and military purpose before they could be in hands to an average man. Now, a computer's main objective in this era is solve problems and cater to the same average man.

As the computers have become more accessible, the need to simplify them has grown. Command line tools, however powerful were seen inferior to the almighty GUI with menus and ton of abstraction layers. Decades were spent simplifying processes and User interfaces that has led to us being unaware of the amazing things a lone computer can do! Although that is changing now with AI and more engineers participating in development of tools catered to the terminal.