This is part of a getting started guide for the Command Prompt on Windows.

Netstat is a built in command line tool that provides you with information about TCP connections, network statistics and IP routing table. As it is built in, there is nothing to download. It is in all recent versions of Windows. Under Windows Vista and Windows 7 you may have to run some commands in an elevated command prompt.

Where to Start

To begin with, start with displaying all connections

netstat -a

That will give you a long list.

Proto Local Address Foreign Address State TCP 0.0.0.0:135 pc01:0 LISTENING TCP 0.0.0.0:445 pc01:0 LISTENING TCP 0.0.0.0:912 pc01:0 LISTENING TCP 0.0.0.0:2002 pc01:0 LISTENING

However that doesn't tell you much about what is going on, unless you know the ports that are in use.

By adding the option -b you can get more information

netstat -a -b or netstat -ab

Proto Local Address Foreign Address State TCP 0.0.0.0:135 desktop1:0 LISTENING RpcSs [svchost.exe] TCP 0.0.0.0:445 pc01:0 LISTENING Can not obtain ownership information TCP 0.0.0.0:912 pc01:0 LISTENING [vmware-authd.exe] TCP 0.0.0.0:2002 pc01:0 LISTENING [LogMeIn.exe] TCP 0.0.0.0:3389 pc01:0 LISTENING CryptSvc [svchost.exe]

You can also list the running processes using the PID using the -o switch.

netstat -ao

Proto Local Address Foreign Address State PID TCP 0.0.0.0:135 pc01:0 LISTENING 768 TCP 0.0.0.0:445 pc01:0 LISTENING 4 TCP 0.0.0.0:912 pc01:0 LISTENING 1512 TCP 0.0.0.0:2002 pc01:0 LISTENING 1704 TCP 0.0.0.0:3389 pc01:0 LISTENING 1160

You can then compare the list with the tasks shown in Task Manager.

With just the -o switch (netstat -o) then you will see just the active connections.

Specific Port Information

If you are looking at the information on pure number form (so IP address and port number) use the -n switch

netstat -an

However this can provide you with more information than you need. Therefore if you are looking for specific port then you can filter that information.

For example to find a connection to web sites or other services using port 80 use this command:

netstat -an | findstr :80

Will show all connections on port 80

| is pipe, which is usually found by pressing SHIFT and then \ on the keyboard. It looks like a broken vertical line on the keyboard.

Repeating the results

If you want to repeat the results at frequent intervals, then you can just place a number at the end, which is the repeat time in seconds.

netstat -an 10

This will show the output of netstat -an every 10 seconds.

To combine the repeat with a filter, put the interval time before the filter:

netstat -an 10 | findstr :80

There is no break of any description between the results, it just appears in a single table, with no time stamp.

Recording the Results

Of course the usual technique to drop the results in to a text file also apply

netstat -an >c:\netstat.txt

netstat /?

Displays protocol statistics and current TCP/IP network connections.

NETSTAT [-a] [-b] [-e] [-f] [-n] [-o] [-p proto] [-r] [-s] [-t] [interval]

-a	Displays all connections and listening ports.
-b	Displays the executable involved in creating each connection or listening port. In some cases well-known executables host multiple independent components, and in these cases the sequence of components involved in creating the connection or listening port is displayed. In this case the executable name is in [ ] at the bottom, on top is the component it called, and so forth until TCP/IP was reached. Note that this option can be time-consuming and will fail unless you have sufficient permissions.
-e	Displays Ethernet statistics. This may be combined with the -s option.
-f	Displays Fully Qualified Domain Names (FQDN) for foreign addresses.
-n	Displays addresses and port numbers in numerical form.
-o	Displays the owning process ID associated with each connection.
-p proto	Shows connections for the protocol specified by proto; proto may be any of: TCP, UDP, TCPv6, or UDPv6. If used with the -s option to display per-protocol statistics, proto may be any of: IP, IPv6, ICMP, ICMPv6, TCP, TCPv6, UDP, or UDPv6.
-r	Displays the routing table.
-s	Displays per-protocol statistics. By default, statistics are shown for IP, IPv6, ICMP, ICMPv6, TCP, TCPv6, UDP, and UDPv6; the -p option may be used to specify a subset of the default.
-t	Displays the current connection offload state.
interval	Redisplays selected statistics, pausing interval seconds between each display. Press CTRL+C to stop redisplaying statistics. If omitted, netstat will print the current configuration information once.

 

Top of the Page - Network Commands Home Page
Last Page Update: 30/03/2015

© Sembee Ltd. 1998 - 2024.

Reproduction of any content on this web site is prohibited without express written consent. Use of this web site is subject to our terms and conditions.

All trademarks and registered trademarks are property of their respective owners. This site is not endorsed or recommended by any company or organisation mentioned within and is to provide guidance only and as such we cannot be held responsible for any consequences of following the advice given.

Sembee Ltd. is registered in England and Wales at 1 Carnegie Road, Newbury, Berkshire, RG14 5DJ.
Registered company number: 4704428. VAT Number GB 904 5603 43.

Server 1