1. What is Netstat?
what is Netstat? Netstat (Network statistic) is a tool that can be used on Windows, Unix and Linux platforms, this tool displays statistics of network connections (inbound and outbound), IP routing table and information on the use of the interface on the network. Used without parameters, the Netstat command displays all active TCP and UDP connections.
Netstat is a very important tool for troubleshooting network related problems. Netstat also helps us to determine network traffic performance. This tool is mostly used by Network Administrators.
2. How to Use Netstat?
You can use Netstat in both Windows and Linux. In order to use Netstat command in windows Type ctrl+r and then type "cmd" if you find this step difficult then you can simply search cmd on the search box of windows and then type "cmd" right-click on the cmd and select run as administrator. And then type netstat -h in cmd to see the available commands.
The Netstat command shows 4 columns by default:
Proto - Protocol that can be TCP, UDP, TCPv6, or UDPv6
Local Address - Local address (your PC)
Foreign Address - Remote
State Address - Displays the state of the network connection that can be CLOSE_WAIT, CLOSED, ESTABLISHED, FIN_WAIT_1, FIN_WAIT_2, LAST_ACK, LISTEN, SYN_RECEIVED, SYN_SEND, and TIME_WAIT
3. Some Important Netstat commands:
netstat -a
The above Netstat command shows all connection ports and open ports (listening ports). The “LISTENING” status means that you are listening, waiting, that is, accepting connections on the respective port. The “ESTABLISHED” status means that there is an active connection on that port.
netstat -n
The above command displays addresses and port numbers in numerical form.
netstat -e
The netstat command with the -e option shows basic connection statistics (Ethernet statistics). The Ethernet interface is usually the LAN card that connects the device to the network.
netstat -s
This netstat command displays statistics by protocol. By default, statistics are shown for the TCP, UDP, ICMP, and IP protocols. If the IPv6 protocol is installed, statistics for TCP over IPv6, UDP over IPv6, ICMPv6, and IPv6 protocols will be displayed.
netstat -r
The above netstat command with the -r option displays the internal routing table.
netstat -p
Shows connections for the specified protocol, which can be TCP, UDP. TCPv6 or UDPv6. If this option is used with the -s option to display statistics by protocol, the protocol can be TCP, UDP, ICMP, IP, tcpv6, udpv6, icmpv6or ipv6.
netstat with interval
The “interval” option allows you to define an interval of seconds within which the statistics generated by the netstat command will be updated.
For example:
netstat -e 30 this command will display basic connection statistics and update it every 15 seconds. Press CTRL + C to stop the display.
It is possible to make use of several parameters together, see the following example:
netstat -a -n | find / i “listening”
The above command will Display only the ports that are listening.
To know more about netstat commands you can go to the official Wikipedia Page.