Understanding Netstat Command

--> netstat (network statistics) is a network utility tool that shows network connections for the Transmission Control Protocol (both incoming and outgoing) and User Datagram Protocol, routing tables, and a number of network interface (network interface controller or software-defined network interface) and network protocol statistics.

--> It is used for finding problems in the network and to determine the amount of traffic on the network as a performance measurement.

--> The command “netstat” displays information about the network ports in use on the system.

--> Netstat comes installed on all current releases of Windows systems. Run with no parameters, netstat will simply display a list of active connections on the local system.

--> The last column shows the current state of the connection. This entry will normally be one of the

following:

LISTENING: The port is open and listening for inbound connections.

ESTABLISHED: The connection is active between the two systems.

TIMED_WAIT: The connection has recently ended.

SYN_SEND, SYN_RECEIVED: Either of these may appear during the initial connection setup.

FIN_WAIT, CLOSE_WAIT, LAST_ACK: Any of these may appear while a connection is being closed.

--> If it says 0.0.0.0 on the Local Address column, it means that port is listening on all 'network interfaces.

--> If it says 127.0.0.1 on the Local Address column, it means that port is ONLY listening for connections from your PC itself, not from the Internet or network.

--> If it displays your online IP on the Local Address column, it means that port is ONLY listening for connections from the Internet.

--> If it displays your local network IP on the Local Address column, it means that port is ONLY listening for connections from the local network.

Netstat Commands

1) netstat -a : will list all TCP and UDP connection information, including information about not only active connections but also ports that are currently open on the system.

2) netstat -n: tells netstat to show all results in numeric format. This displays IP addresses and ports as numbers rather than trying to convert them to some type of name.

3) netstat -o : shows the process identifier (PID) of the process that is bound to a listening port or that is using an established connection.This can be extremely useful in determining why a particular port is open.