Which utility would you use to view current connections and active sessions and ports on a computer?

What is Traceroute (tracert)?

Whether at home or at your business: network issues can really grind one’s gears. When ensuring that all the cables have been connected and the settings have been checked multiple times is of no help, it may be time to make use of traceroute or tracert. These help users find the source of all their frustration.

What is Traceroute (tracert)?

With Linux, access rights for directories and files are often set through the terminal where file owners can be defined and groups can be assigned. With the ‘chmod’ command, user classes can be assigned certain file rights. Access rights in the Unix file system can be changed in two different ways: symbolic or numeric. Find out more about both notation types here.

What is chmod?

Creating a batch file: How to write your own .bat file

Windows operating systems can be controlled and configured in a wide variety of ways. To this day, experienced administrators use Command Prompt, the Windows command-line interpreter, for this purpose. If you want to have Windows automatically process a sequence of commands, you can create a batch file. This tutorial will show you how.

Creating a batch file: How to write your own .bat file

Netsh – how to manage networks with Netsh commands

Netsh is a versatile command line tool for administrating networks on Windows. Once you’ve learned the syntax and its special structure, you can solve a range of tasks and problems. Get to know the Netsh commands and find out how to administrate Windows networks comfortably, and efficiently via Windows command prompt.

Netsh – how to manage networks with Netsh commands

Port tests: Checking open ports with a port check

Ports are the doors through which operating systems and software communicate with the Internet. Data can be transmitted in both directions via open ports and assigned to specific target addresses and local applications. At the same time, open ports can create a vulnerability and a point of entry for malware and hackers. As such, regularly checking for open ports is recommended. Learn how to check...

Port tests: Checking open ports with a port check

The netstat command, meaning network statistics, is a Command Prompt command used to display very detailed information about how your computer is communicating with other computers or network devices.

Specifically, it can show details about individual network connections, overall and protocol-specific networking statistics, and much more, all of which could help troubleshoot certain kinds of networking issues.

This command is available from within the Command Prompt in most versions of Windows, including Windows 11, Windows 10, Windows 8, Windows 7, Windows Vista, Windows XP, Windows Server operating systems, and some older versions of Windows, too.

Netstat is a cross-platform command, which means it's also available in other operating systems like macOS and Linux.

The availability of certain netstat command switches and other netstat command syntax may differ from operating system to operating system.

netstat [-a] [-b] [-e] [-f] [-n] [-o] [-p protocol] [-r] [-s] [-t] [-x] [-y] [time_interval] [/?]

Here are several examples showing how the netstat command might be used:

In this first example, we execute netstat to show all active TCP connections. However, we want to see the computers that we're connected to in FQDN format [-f] instead of a simple IP address.

Here's an example of what you might see:

As you can see, there were 11 active TCP connections at the time netstat was executed in this example. The only protocol (in the Proto column) listed is TCP, which was expected because we didn't use -a.

You can also see three sets of IP addresses in the Local Address column—the actual IP address of 192.168.1.14 and both IPv4 and IPv6 versions of the loopback addresses, along with the port each connection is using. The Foreign Address column lists the FQDN (75.125.212.75 didn't resolve for some reason) along with that port as well.

Finally, the State column lists the TCP state of that particular connection.

In this example, netstat will be run normally so it only shows active TCP connections, but we also want to see the corresponding process identifier [-o] for each connection so that we can determine which program on the computer initiated each one.

Here's what the computer displayed:

You probably noticed the new PID column. In this case, the PIDs are all the same, meaning that the same program on the computer opened these connections.

To determine what program is represented by the PID of 2948 on the computer, all you have to do is open Task Manager, select the Processes tab, and note the Image Name listed next to the PID we're looking for in the PID column.1

Using the netstat command with the -o option can be very helpful when tracking down which program is using too big a share of your bandwidth. It can also help locate the destination where some kind of malware, or even an otherwise legitimate piece of software, might be sending information without your permission.

While this and the previous example were both run on the same computer, and within just a minute of each other, you can see that the list of active TCP connections is considerably different. This is because your computer is constantly connecting to, and disconnecting from, various other devices on your network and over the internet.

The above example is similar to what we've already looked at, but instead of displaying all connections, we're telling the netstat command to show only the connections that are using a specific PID, 28604 in this example.

A similar command could be used to filter out the connections with a CLOSE_WAIT state, by replacing the PID with ESTABLISHED.

In this example, we want to see protocol specific statistics [-s] but not all of them, just TCP stats [-p tcp]. We also want the foreign addresses displayed in FQDN format [-f].

This is what the netstat command, as shown above, produced on the example computer:

As you can see, various statistics for the TCP protocol are displayed, as are all active TCP connections at the time.

In this final example, netstat command is executed to show some basic network interface statistics [-e] and so that these statistics continually updated in the command window every five seconds [-t 5].

Here's what's produced on screen:

Various pieces of information, which you can see here and that we listed in the -e syntax above, are displayed.

The netstat command only automatically executed one extra time, as you can see by the two tables in the result. Note the ^C at the bottom, indicating that the Ctrl+C abort command was used to stop the re-running of the command.

The netstat command is often used with other networking related Command Prompt commands like nslookup, ping, tracert, ipconfig, and others.

[1] You might have to manually add the PID column to Task Manager. You can do this by selecting PID after right-clicking the column headings in the Process tab. If you're using Windows 7 or on older Windows OS, select the PID (Process Identifier) checkbox from View > Select Columns in Task Manager. You might also have to choose Show processes from all users from the bottom of the Processes tab if the PID you're looking for isn't listed.

FAQ

• How do I use netstat to look up my proxy?

  Run ntestat -ban and look through the list for the Process Identifier (PID) of iexplore.exe. This sill show you the proxy port and IP of your system.

• What's the difference between netstat and nbstat commands?

  In general, netstat commands are used to display TCP and IP address info, while nbstat commends specifically pertain to NetBIOS statitstics.

Thanks for letting us know!

Get the Latest Tech News Delivered Every Day

Tell us why!