netstat is one of the most commonly used tool in Windows and UNIX & Linux operating systems to troubleshoot TCP/IP connections. Netstat displays active TCP connections, ports on which the computer is listening, Ethernet statistics, the IP routing table, IPv4 statistics (for the IP, ICMP, TCP, and UDP protocols), and IPv6 statistics (for the IPv6, ICMPv6, TCP over IPv6, and UDP over IPv6 protocols). Used without parameters, netstat displays active TCP connections. The netstat tool can display all the active TCP/UDP connections on various ports on the source IP and ports along with the foreign IPs and ports. It also can display on the various ports on which the local IP/Ports are listening for incoming connections (ex: a webserver listens on port 80 for HTTP requests).

To simple display the active TCP connctions from the command prompt,

C:\>netstat

Active Connections

Proto Local Address Foreign Address State

TCP mytestpc:2325 ug-in-f189.google.com:http ESTABLISHED

TCP mytestpc:2337 eh-in-f191.google.com:http ESTABLISHED

TCP mytestpc:2370 cs27.msg.dcn.yahoo.com:5050 ESTABLISHED

TCP mytestpc:2374 sip47.voice.re2.yahoo.com:https ESTABLISHED

TCP mytestpc:2701 66.29.87.160:http CLOSE_WAIT TCP

mytestpc:2702 84.53.134.207:http CLOSE_WAIT

TCP mytestpc:2741 ug-in-f83.google.com:http ESTABLISHED

TCP mytestpc:2813 fg-in-f19.google.com:http CLOSE_WAIT

TCP mytestpc:2939 mg2e.mail.vip.dcn.yahoo.com:http ESTABLISHED

Using with the "-n" switch will not perform a DNS lookup and show the above in IP and port numbers only

C:\>netstat -n

Active Connections

Proto Local Address Foreign Address State

TCP 192.168.0.2:2325 66.249.93.189:80 ESTABLISHED

TCP 192.168.0.2:2337 72.14.207.191:80 ESTABLISHED

TCP 192.168.0.2:2370 216.155.193.154:5050 ESTABLISHED

TCP 192.168.0.2:2374 68.142.233.144:443 ESTABLISHED

TCP 192.168.0.2:2701 66.29.87.160:80 CLOSE_WAIT

TCP 192.168.0.2:2702 84.53.134.207:80 CLOSE_WAIT

TCP 192.168.0.2:2741 66.249.93.83:80 ESTABLISHED

TCP 192.168.0.2:2813 72.14.221.19:80 CLOSE_WAIT

To display all the TCP/UDP connections and the port listened on use "-a".

Note: When used with a "-n" will display the IPs and port numbers as it disables the DNS Lookup

C:\Program Files\Windows Resource Kits\Tools>netstat -an

Active Connections

Proto Local Address Foreign Address State

TCP 0.0.0.0:135 0.0.0.0:0 LISTENING

TCP 0.0.0.0:445 0.0.0.0:0 LISTENING

TCP 0.0.0.0:2869 0.0.0.0:0 LISTENING

TCP 0.0.0.0:5051 0.0.0.0:0 LISTENING

TCP 0.0.0.0:5101 0.0.0.0:0 LISTENING

TCP 0.0.0.0:52991 0.0.0.0:0 LISTENING

TCP 127.0.0.1:1072 0.0.0.0:0 LISTENING

TCP 127.0.0.1:4242 0.0.0.0:0 LISTENING

TCP 192.168.0.2:139 0.0.0.0:0 LISTENING

TCP 192.168.0.2:2325 66.249.93.189:80 ESTABLISHED

TCP 192.168.0.2:2337 72.14.207.191:80 ESTABLISHED

TCP 192.168.0.2:2370 216.155.193.154:5050 ESTABLISHED

TCP 192.168.0.2:2374 68.142.233.144:443 ESTABLISHED

TCP 192.168.0.2:2701 66.29.87.160:80 CLOSE_WAIT

TCP 192.168.0.2:2702 84.53.134.207:80 CLOSE_WAIT

TCP 192.168.0.2:2741 66.249.93.83:80 ESTABLISHED

TCP 192.168.0.2:2942 72.14.221.19:80 ESTABLISHED

UDP 0.0.0.0:445 *:* UDP 0.0.0.0:500 *:*

UDP 0.0.0.0:1041 *:*

UDP 0.0.0.0:1042 *:*

UDP 0.0.0.0:1052 *:*

UDP 0.0.0.0:4500 *:*

UDP 0.0.0.0:5051 *:*

UDP 127.0.0.1:123 *:*

UDP 127.0.0.1:1220 *:*

UDP 127.0.0.1:1435 *:*

UDP 127.0.0.1:1900 *:*

UDP 127.0.0.1:2313 *:*

UDP 127.0.0.1:2419 *:*

UDP 192.168.0.2:123 *:*

UDP 192.168.0.2:137 *:*

UDP 192.168.0.2:138 *:*

UDP 192.168.0.2:1900 *:*

UDP 192.168.0.2:2378 *:*

UDP 192.168.0.2:2383 *:*

UDP 192.168.0.2:2386 *:*

UDP 192.168.0.2:2387 *:*

To see the ethernet interface statistics,

C:\Program Files\Windows Resource Kits\Tools>netstat -e

Interface Statistics

                                             Received Sent

Bytes                                     42901938 25599009

Unicast packets                      185168 181830

Non-unicast packets                2406 1892

Discards                                0 0

Errors                                   0 43

Unknown protocols                 505

To show the owner process ID (PID) use the "-0"

C:\Program Files\Windows Resource Kits\Tools>netstat -on

Active Connections

Proto Local Address Foreign Address State PID

TCP 192.168.0.2:2337 72.14.207.191:80 ESTABLISHED 2680

TCP 192.168.0.2:2370 216.155.193.154:5050 ESTABLISHED 3448

TCP 192.168.0.2:2374 68.142.233.144:443 ESTABLISHED 3448

TCP 192.168.0.2:2701 66.29.87.160:80 CLOSE_WAIT 3144

TCP 192.168.0.2:2702 84.53.134.207:80 CLOSE_WAIT 3144

TCP 192.168.0.2:2741 66.249.93.83:80 ESTABLISHED 2680

TCP 192.168.0.2:2942 72.14.221.19:80 CLOSE_WAIT 1780

TCP 192.168.0.2:2948 66.249.93.83:80 TIME_WAIT 0

TCP 192.168.0.2:2950 66.249.93.189:80 ESTABLISHED

A step further would be to show the process application which owns the connection, use "-b"

 C:\Program Files\Windows Resource Kits\Tools>netstat -bn

Active Connections

Proto Local Address Foreign Address State PID

TCP 192.168.0.2:2337 72.14.207.191:80 ESTABLISHED 2680 [IEXPLORE.EXE]

TCP 192.168.0.2:2370 216.155.193.154:5050 ESTABLISHED 3448 [YAHOOM~1.EXE]

TCP 192.168.0.2:2374 68.142.233.144:443 ESTABLISHED 3448 [YAHOOM~1.EXE]

TCP 192.168.0.2:2741 66.249.93.83:80 ESTABLISHED 2680 [IEXPLORE.EXE]

TCP 192.168.0.2:2950 66.249.93.189:80 ESTABLISHED 2680 [IEXPLORE.EXE]

TCP 192.168.0.2:2955 209.73.178.33:80 ESTABLISHED 2680 [IEXPLORE.EXE]

TCP 192.168.0.2:2701 66.29.87.160:80 CLOSE_WAIT 3144 [fdm.exe]

TCP 192.168.0.2:2702 84.53.134.207:80 CLOSE_WAIT 3144 [fdm.exe]

TCP 192.168.0.2:2942 72.14.221.19:80 CLOSE_WAIT 1780 [iexplore.exe]

To see at the protocol level use the "-p" switch with the protocol name,

Note: using with "-s" option shows protocol wise statistics

C:\Program Files\Windows Resource Kits\Tools>netstat -np tcp

Active Connections Proto Local Address Foreign Address State

TCP 192.168.0.2:2337 72.14.207.191:80 ESTABLISHED

TCP 192.168.0.2:2370 216.155.193.154:5050 ESTABLISHED

TCP 192.168.0.2:2374 68.142.233.144:443 ESTABLISHED

TCP 192.168.0.2:2701 66.29.87.160:80 CLOSE_WAIT

TCP 192.168.0.2:2702 84.53.134.207:80 CLOSE_WAIT

TCP 192.168.0.2:2741 66.249.93.83:80 ESTABLISHED

TCP 192.168.0.2:2942 72.14.221.19:80 CLOSE_WAIT

TCP 192.168.0.2:2950 66.249.93.189:80 ESTABLISHED

TCP 192.168.0.2:2964 68.180.207.182:80 TIME_WAIT

To display the Routing table on the system use "-r" switch. Note: Equivalent to the "route print" command in Windows

C:\Program Files\Windows Resource Kits\Tools>netstat -r

Route Table ============================================================== Interface List 0x1 ……………………… MS TCP Loopback

interface 0x3 …00 13 ce 85 0e e1 …… Intel(R) PRO/Wireless 2200BG Network Connection – Packet Scheduler Miniport

0x10005 …00 ff 28 e3 2e 8a …… Juniper Network Connect Virtual Adapter

0x50002 …00 14 22 fd 5b 8d …… Broadcom NetXtreme 57xx Gigabit Controller – Packet Scheduler Miniport ============================================================= Active Routes:

Network Destination Netmask Gateway Interface Metric

0.0.0.0 0.0.0.0 192.168.0.1 192.168.0.2 25

127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1

192.168.0.0 255.255.255.0 192.168.0.2 192.168.0.2 25

192.168.0.2 255.255.255.255 127.0.0.1 127.0.0.1 25

192.168.0.255 255.255.255.255 192.168.0.2 192.168.0.2 25

224.0.0.0 240.0.0.0 192.168.0.2 192.168.0.2 25

255.255.255.255 255.255.255.255 192.168.0.2 10005 1

255.255.255.255 255.255.255.255 192.168.0.2 192.168.0.2 1

255.255.255.255 255.255.255.255 192.168.0.2 50002 1

Default Gateway: 192.168.0.1 ============================================================== Persistent Routes: None

Note: using "-n" with any of the above will disable DNS lookup for faster response.

If you're new here, you may want to subscribe to my RSS feed. Thanks for visiting!