Networking

The netstat Command

The netstat command displays the protocol statistics and current TCP/IP connections on the local system. Used without any switches, the netstat command shows the active connections for all outbound TCP/IP connections. In addition, several switches are available that change the type of information netstat displays. Table 5 shows the various switches available for the netstat utility.

Table 5 netstat Switches

Switch

Description

-a

Displays the current connections and listening ports

-e

Displays Ethernet statistics

-n

Lists addresses and port numbers in numerical form

-p

Shows connections for the specified protocol

-r

Shows the routing table

-s

Lists per-protocol statistics

interval

Specifies the length of time to wait before redisplaying statistics

The netstat utility is used to show the port activity for both TCP and UDP connections, showing the inbound and outbound connections. When used without switches, the netstat utility has four information headings.

  • Proto Lists the protocol being used, either UDP or TCP.

  • Local address Specifies the local address and port being used.

  • Foreign address Identifies the destination address and the port being used.

  • State Specifies whether the connection is established.

In its default usage, the netstat command shows outbound connections that have been established by TCP. The following shows a sample output from a netstat command without using any switches:

C:\>netstat
Active Connections
  Proto  Local Address          Foreign Address        State
  TCP    laptop:2848            MEDIASERVICES1:1755    ESTABLISHED
  TCP    laptop:1833            www.test.com:80  ESTABLISHED
  TCP    laptop:2858            194.70.58.241:80       ESTABLISHED
  TCP    laptop:2860            194.70.58.241:80       ESTABLISHED
  TCP    laptop:2354            www.test.com:80  ESTABLISHED
  TCP    laptop:2361            www.test.com:80  ESTABLISHED
  TCP    laptop:1114            www.test.com:80  ESTABLISHED
  TCP    laptop:1959            www.test.com:80  ESTABLISHED
  TCP    laptop:1960            www.test.com:80  ESTABLISHED
  TCP    laptop:1963            www.test.com:80  ESTABLISHED
  TCP    laptop:2870            localhost:8431         TIME_WAIT
  TCP    laptop:8431            localhost:2862         TIME_WAIT
  TCP    laptop:8431            localhost:2863         TIME_WAIT
  TCP    laptop:8431            localhost:2867         TIME_WAIT
  TCP    laptop:8431            localhost:2872         TIME_WAIT

Like any other command-line utility, they are often used with switches. The following sections provide a brief explanation of the switches and a sample output from each.