The Power of Netstat

Contributed by davak September 10, 2003  
Tagged: Windows

View all connections and listening ports

Several win programs allow one to see who is connected to the local machine. However, there is a dos-based command that works just as well.

netstat

Sample output:

Active Connections

Proto Local Address Foreign Address State
TCP ertwheel:1310 64.xx.25.8:xxxx ESTABLISHED
TCP ertwheel:1311 205.xxx.6.222:xxxx ESTABLISHED
TCP ertwheel:1541 host131.samplesite.com:ftp ESTABLISHED
TCP ertwheel:4192 192.xxx.0.1:xxxx CLOSE_WAIT

Other options commands:
NETSTAT [-a] [-e] [-n] [-s] [-p proto] [-r] [interval]

-a Displays all connections and listening ports.
-e Displays Ethernet statistics. This may be combined with the -s option.
-n Displays addresses and port numbers in numerical form.
-p proto Shows connections for the protocol specified by proto; proto may be TCP or UDP. If used with the -s option to display per-protocol statistics, proto may be TCP, UDP, or IP.
-r Displays the routing table.
-s Displays per-protocol statistics. By default, statistics are shown for TCP, UDP and IP; the -p option may be used to specify a subset of the default.
interval Redisplays selected statistics, pausing interval seconds between each display. Press CTRL+C to stop redisplaying statistics. If omitted, netstat will print the current configuration information once.