Windows Command #15 covers netstat, a built-in command-line utility for examining network connections, listening ports, protocol statistics, process IDs, and routing information. It is especially useful when troubleshooting servers, workstations, applications, and network services.

Show Active Connections

netstat

Used without parameters, netstat displays active TCP connections.

Show Connections and Listening Ports

netstat -a

The -a option adds TCP and UDP listening ports. This is useful when checking whether a service is actually listening for connections.

Use Numeric Addresses

netstat -n

The -n option displays IP addresses and port numbers numerically instead of resolving names.

Find the Owning Process

netstat -ano

This practical combination displays connections and listening ports numerically and includes the owning process ID, or PID. You can compare the PID with Task Manager to identify the application using a connection or port.

Filter the Output

netstat -ano | findstr LISTENING
netstat -ano | findstr :443

Piping output into findstr helps isolate a connection state or port. The second example looks for entries containing port 443.

Protocol Statistics and Routes

netstat -s
netstat -r

netstat -s displays statistics by protocol. netstat -r displays the IP routing table, equivalent to route print.

Practical Troubleshooting

If an application cannot accept connections, first confirm that the expected port is listening. If a port is unexpectedly occupied, use netstat -ano to obtain its PID and identify the owning process. Treat unfamiliar connections as leads for investigation, not automatic proof of malicious activity.

Video Reference

PowerCert Animated Videos provides a focused visual explanation of NETSTAT, including network connections, ports, states, and practical command output.

Practice

Open Command Prompt and run netstat -ano. Identify one ESTABLISHED connection and one LISTENING entry, note their local ports and PIDs, and then locate the corresponding process in Task Manager. This connects command-line network information to the actual Windows process using it.

Reference: Microsoft Learn documentation for the Windows netstat command.