Info-x: A Brief Look At: Netstat

Message

   Description: 

This command is available only if the TCP/IP protocol has been installed. 

This command should be executed from the command line.

Provides statistics on the following network components:

    Foreign Address

    The IP address and port number of the remote computer to which the socket 

      is connected. 

      The name corresponding to the IP address is shown instead of the number 

      if the HOSTS file contains an entry for the IP address.

      In cases where the port is not yet established, the port number is shown 

      as an asterisk (*).

    Local Address

    The IP address of the local computer, as well as the port number the connection 

      is using. 

      The name corresponding to the IP address is shown instead of the number 

      if the HOSTS file contains an entry for the IP address. In cases where the 

      port is not yet established, the port number is shown as an asterisk (*).

    Proto

    The name of the protocol used by the connection.

    (state)

    Indicates the state of TCP connections only. The possible states are 

      CLOSED

        FIN_WAIT_1 

        SYN_RECEIVED

        CLOSE_WAIT 

        FIN_WAIT_2 

        SYN_SEND

        ESTABLISHED 

        LISTEN 

        TIMED_WAIT

        LAST_ACK

Parameters:

    netstat [-a] [-e] [-n] [-s] [-p protocol] [-r] [interval]

    -a

    Displays all connections and listening ports; server connections are normally 

      not shown.

    -e

    Displays Ethernet statistics. This may be combined with the -s option.

    -n

    Displays addresses and port numbers in numerical form (rather than attempting 

      name look-ups).

    -s

    Displays per-protocol statistics. By default, statistics are shown for 

      TCP, UDP, ICMP, and IP; the -p option may be used to specify a subset of 

      the default. 

    -p protocol

    Shows connections for the protocol specified by proto; proto may be TCP 

      or UDP. If used with the -s option to display per-protocol statistics, proto 

      may be TCP, UDP, ICMP, or IP.

    -r

    Displays the contents of the routing table.

    interval

    Re displays selected statistics, pausing interval seconds between each 

      display. Press CTRL+C to stop redisplaying statistics. If this parameter 

      is omitted, n e t s t a t prints the current configuration information once.

Example:

            C:\\>netstat -e

        Interface Statistics

          Received

          Sent

            Bytes 

          376499563

          220189369

            Unicast packets

          1065776

          965622

            Non-unicast packets

          76727 

          1310

            Discards

          0

          0

            Errors

          0

          0

            Unknown protocols

          0