How to fix socket error 10013 in Windows?

Socket error 10013 is the Windows error WSAEACCES: a program asked for a network port or connection and Windows refused it. Most often today the port sits inside a block that Hyper-V, WSL or Docker reserved, or another program holds it exclusively. Check the excluded port ranges first, then move the app to a free port (Fix 1).

Facts checked on 15 October 2026. Steps written for Commands and paths read against Microsoft Learn on 15 October 2026 for Windows 11 25H2 and 26H2 and Windows 10 22H2.

What socket error 10013 means

A socket is the endpoint a program uses to talk over the network, and a port is the number on that endpoint. When a program asks Windows for a socket or a port and Windows says no for a reason of permission, the program gets error code 10013. Microsoft's list of Windows Sockets error codes names it WSAEACCES and describes it as "Permission denied. An attempt was made to access a socket in a way forbidden by its access permissions."

Microsoft gives two examples. A program sends to a broadcast address without first turning on broadcast permission. Or, when a program binds a port, another application, service or kernel mode driver is already bound to the same address with exclusive access. The second case is the one ordinary users meet. Despite the old name "raw socket error", the code is not limited to raw sockets: any socket can get it.

• Python: PermissionError: [WinError 10013] An attempt was made to access a socket in a way forbidden by its access permissions or, in older code, socket.error: [Errno 10013].
• Command-line tools: (os error 10013), for example "failed to start login server: An attempt was made to access a socket in a way forbidden by its access permissions. (os error 10013)" when a tool starts a small sign-in server on your PC.
• LocalSend: SocketException: Failed to create server socket (OS Error: An attempt was made to access a socket in a way forbidden by its access permissions. errno=10013), address=0.0.0.0, port=53317.
• Terminal and SSH programs: "Unexpected socket error: 10013 filename: unspecified line number: 0". Google links this wording to SecureCRT. We could not confirm it in the vendor's documentation.
• Programmers: the value 10013 returned by WSAGetLastError after bind, sendto or connect.
• Not this error: Netflix error 10013 and the Event Viewer line "The internal error state is 10013" are different messages that only share the number. See the FAQ.

Why Windows refuses the socket

Microsoft does not publish how often each cause occurs. The order below follows what the sources show: Microsoft's own description of the code, Microsoft's article on excluded ports, and a long public bug report from LocalSend users on Windows 10 and 11 in 2026. The common thread is a port that looks free but is not available to your program.

Microsoft gives the default dynamic port range as 49,152 to 65,535. That is where reserved blocks usually appear, and it is why apps with a default port in that range, such as LocalSend on 53317, are hit most. In the LocalSend report, one user showed blocks such as 53286 to 53385 in the list, and another showed 53272 to 53371. Both contain 53317.

How to fix socket error 10013

Fixes 1 to 4 deal with the port itself and solve the common cases. Fix 5 is for programs that fail on outgoing connections. Fixes 6 and 7 are general repairs for when many programs fail at once.

Fix 1. Check the excluded port ranges and give the program a free port

5 minutesNo riskA program fails when it starts its own server or listener, and you can change the port in its settings.

Windows refuses any bind inside a reserved range, even when no program uses the port. A port outside every listed range is accepted at once, which is what LocalSend users report after moving from 53317 to 54000.

1. Note the port the program uses. It is in the error text, in the program's settings or in its documentation.
2. Right-click Start and select Terminal (Admin). On Windows 10 select Windows PowerShell (Admin) or open Command Prompt as administrator.
3. Run the first command below and read the list of Start Port and End Port pairs.
4. Check whether your port falls between a Start Port and an End Port. Lines with a * are administered exclusions that someone added by hand.
5. Run the second command, with your port number, to see whether any process uses it.
6. In the program's settings, choose a port that is outside every listed range and not shown by netstat. Ports below 49152 are less likely to be reserved.
7. Restart the program. If other devices or programs connect to it, change the port on their side as well.

Show reserved TCP ports, then check one port (replace 53317 with yours)

netsh interface ipv4 show excludedportrange protocol=tcp
netstat -ano | findstr :53317

• LocalSend: open Settings, change the port, restart the app and set the same port on the other devices. One user in the report found that 54000 worked while 53316 and 53318 did not, because they were in the same reserved block.
• Local web servers and scripts: start them with another port, for example --port 8080 or the setting your framework uses.
• SSH port forwarding: change the local port of the forward in the session settings.
• Programs with a fixed port: if you cannot change the port, go to Fix 2 to free the block or Fix 4 to reserve the port.

Fix 2. Restart the WinNAT service to release the reserved blocks

3 minutesLow riskThe port is inside an excluded range, Hyper-V, WSL 2 or Docker Desktop is installed, and the program's port cannot be changed.

The Windows NAT driver (WinNAT) serves the virtual networks of Hyper-V, WSL 2 and Docker, and users in the LocalSend report tie the reserved blocks to it. One user reports that restarting the winnat service removed the block and LocalSend started on its default port.

1. Right-click Start and select Terminal (Admin), then confirm with Yes.
2. Run the command below. It stops and starts the WinNAT service in one step.
3. Run netsh interface ipv4 show excludedportrange protocol=tcp again and check whether your port is still inside a range.
4. Start the program that failed.

Restart WinNAT (PowerShell as administrator)

Restart-Service -Name winnat

Fix 3. Find the program that already holds the port and stop it

5 minutesLow risknetstat -ano shows a process listening on the port your program needs.

Microsoft's description of 10013 names this case: another application, service or kernel mode driver is bound to the same address with exclusive access. Your program gets access only after that one lets go of the port.

1. Open Terminal (Admin) and run the first command below with your port number.
2. Note the number in the last column of the LISTENING line. That is the process ID (PID).
3. Run the second command with that PID to see the program's name.
4. Close that program in the normal way, or stop its service. If it is a program you need, change its port or your program's port instead.
5. If the name is a web server such as IIS, run iisreset /stop as administrator to stop it, and iisreset /start when you want it back.
6. Start the program that showed error 10013.

Who listens on the port, and which program it is (replace the numbers)

netstat -ano | findstr :8080
tasklist /FI "PID eq 1234"

Do not end a process you do not recognise in Task Manager. Look the name up first: some ports are held by Windows services that other parts of the system need. Restarting a Windows service the safe way: Check and restart Windows services

Fix 4. Reserve the port for your program so Windows does not take it again

10 minutesLow riskThe port must stay fixed, and Fix 2 helps only until the next restart.

An administered exclusion added with netsh keeps a port out of the pool that Windows hands out, so automatic reservations cannot land on it. Microsoft documents the command and notes that the program can still bind the excluded port.

1. Open Terminal (Admin).
2. Stop WinNAT with the first command, so that no automatic block covers your port while you add the reservation.
3. Add the exclusion with the second command, with your port as startport.
4. Start WinNAT again with the third command.
5. Run netsh interface ipv4 show excludedportrange protocol=tcp and check that your port is listed with a *.
6. Start your program.

Reserve one TCP port (replace 53317 with yours)

Stop-Service -Name winnat
netsh int ipv4 add excludedportrange protocol=tcp startport=53317 numberofports=1
Start-Service -Name winnat

Fix 5. Allow the program in the firewall and test your security program once

10 minutesLow riskThe program fails on outgoing connections, for example mail, SSH, a game or a sync client, or only this PC is affected.

A firewall or security suite that blocks a program's socket can make Windows return an access error instead of a timeout. A short test shows whether the security program is the cause, and an allow rule fixes it without leaving protection off.

1. Open your third-party firewall or security suite, if you have one, and look in its log for the program's name at the time of the error.
2. If it was blocked, add the program to the allowed list there.
3. If you use only Windows protection, open Start, type Windows Security, select Firewall & network protection > Allow an app through firewall and check that the program is allowed on your network type.
4. If nothing is logged, pause the security program's protection for one test, run the program once, then turn protection back on, whatever the result.

Fix 6. Reset Winsock and TCP/IP

10 minutesLow riskSeveral programs report 10013, ipconfig /renew fails with it, or it started after a VPN or security program was installed or removed.

VPN and security programs add themselves to the Windows sockets catalog. A Winsock reset returns that catalog to its default state. In the LocalSend report, users on Windows 11 report that netsh winsock reset and a restart cleared the error.

1. Note any IP address or DNS server you entered by hand, because the TCP/IP reset can remove it.
2. Open Terminal (Admin) and run the commands below one after the other.
3. Restart the PC.
4. Run the program again. If you came here from ipconfig /renew, run that command again.

Reset the sockets catalog and TCP/IP

netsh winsock reset
netsh int ip reset

A VPN client may need to be repaired or reinstalled afterwards. The full reset, with the Network reset button in Settings: Reset the network and flush DNS

Fix 7. Undo the change that started it with System Restore

30 minutesRead the warningThe error started on a known day, for example after an update, a driver or a new program, and nothing above helped.

System Restore takes system files, drivers and installed programs back to a restore point without touching your documents. If a recent install changed how Windows hands out ports or sockets, this removes it.

1. Open System Restore. Press Windows+R, type the command below and press Enter. You can also open Control Panel > Recovery > Open System Restore. If a first page opens, select Next.

   rstrui.exe

2. Choose a restore point. Select a restore point from a time before the problem started. The Description often names the event, such as a driver or app install. If the one you need is missing, select Show more restore points (shown only when there are more).
3. See what will change. Select Scan for affected programs. The upper list shows programs and drivers that will be removed; the lower list shows those that might come back and may need to be reinstalled. Select Close.
4. Start the restore. Select Next, check the summary and select Finish. Windows restarts and applies the restore point. Do not turn the PC off.
5. Check the result. After sign-in Windows reports whether the restore succeeded. Check whether the problem is gone.

These steps were written for Windows 11 and Windows 10 (the steps are the same). The full page with the other versions and what each result means: Undo recent changes with System Restore

If socket error 10013 is still there

We found no Event Viewer entry that Microsoft documents for this error. The facts that explain it are the port lists. Save them to a file and send them with your report to the program's developer or your IT department.

Save the facts to a text file on the desktop

netsh interface ipv4 show excludedportrange protocol=tcp > "%USERPROFILE%\Desktop\ports.txt"
netstat -ano >> "%USERPROFILE%\Desktop\ports.txt"

• What to send: the full error text, the port, the program and its version, your Windows version, and the file above.
• Work PC: do not change ports or reservations on a managed PC. The reserved ranges there may be set by your administrator on purpose.
• When it is not your PC: if the error names a remote server and other people get it too, the server refused the connection. Only its owner can fix that.
• Hardware: 10013 is a permission answer from Windows, not a sign of a broken network card.

How to keep error 10013 from coming back

Frequently asked questions

What does error code 10013 mean?

It means Windows refused a program access to a socket. Microsoft names the code WSAEACCES. Its text reads "An attempt was made to access a socket in a way forbidden by its access permissions". In practice a program wanted a port that is reserved by Windows or held exclusively by another program, or a security program blocked the connection. The code says nothing about your internet connection, which can work fine for every other app. The fastest check is the list of excluded port ranges, shown with netsh interface ipv4 show excludedportrange protocol=tcp.

How do I fix WinError 10013 in Python?

Python raises PermissionError: [WinError 10013] when the socket call fails with WSAEACCES, so the fix is the same as for any other program. Check whether the port in your bind call is inside an excluded range, and use one outside it, for example 8080 instead of a port above 49152. If netstat -ano shows another process on the port, stop it or pick another port. If you send to a broadcast address, set the SO_BROADCAST option on the socket first: Microsoft names a broadcast without that permission as one cause of 10013.

What does "os error 10013" mean?

It is the same Windows error 10013 printed by a command-line tool in its own format. In Google's results for this spelling, most cases are tools that start a small local server for sign-in, such as the Codex CLI login, and fail with "failed to start login server". The tool could not open its local port. Check the excluded port ranges as in Fix 1, restart WinNAT as in Fix 2 if Hyper-V, WSL or Docker is installed, and run the sign-in again. If the tool lets you choose the port, choose one outside every listed range.

Why does LocalSend show error 10013?

Because its default port 53317 often falls inside a range that Windows reserved. In LocalSend's public bug report from 2026, users on Windows 10 and 11 show ranges such as 53286 to 53385 that contain 53317, while netstat shows the port as free. Users report three ways out: change the port in LocalSend's settings to one outside the ranges, such as 54000, on every device; restart the winnat service; or run netsh winsock reset and restart. The report is still open, so we found no fixed LocalSend version.

Does running the program as administrator fix error 10013?

Sometimes, but not in the most common case. Administrator rights do not let a program bind a port inside an excluded range or one held with exclusive access by another program. The reporter of the LocalSend bug ran the app as administrator and still got 10013. Running as administrator is still worth one try for tools that build their own network packets, but if it does not help, go back to Fix 1. Never set a program to always run as administrator just to hide this error.

Is socket error 10013 caused by the firewall?

Sometimes, but less often than many guides claim. A firewall or security suite that blocks a program's socket can produce the code, mostly for outgoing connections. For programs that fail when they open their own port, the cause is usually a reserved range or another program on the port, and the firewall plays no part. Allow the program in the firewall rather than turning the firewall off, and pause a security program only for one test, as in Fix 5.

Why does ipconfig /renew give error 10013?

We could not find a Microsoft page that explains this case. The message means the command could not get the socket it needed to ask for a new address. Users most often report it after a VPN or security program changed the network settings. Reset Winsock and TCP/IP as in Fix 6 and restart the PC, then run ipconfig /renew again. If it still fails, run it once with your VPN disconnected and your security program paused for a single test, then turn protection back on.

What is "The internal error state is 10013"?

It is a different message that only shares the number. Google pairs it with questions about TLS, the encryption of connections, so it concerns a failed secure connection logged in Event Viewer, not a program that cannot open a port. We did not research that event for this page, and the steps here do not apply to it. If you came here from Event Viewer, look at the event's source and ID before you change anything: such events are often harmless and appear without any visible problem.

Is Netflix error 10013 the same thing?

No. Netflix uses its own error codes, and its code 10013 is not the Windows socket error, even though the number matches. This page is about the Windows error WSAEACCES that programs report when Windows refuses them a socket. For the Netflix code, follow Netflix's own help page for that code. The same is true for "10013 in Word": Microsoft Word does not open network ports, so a 10013 there is not this error.