Professional Windows Server 1002003 Security A Technical Reference [Electronic resources] نسخه متنی

Displays statistics and current connections
for TCP/IP.

Syntax

netstat [-a] [-e] [-n] [-s] [-p protocol] [-r] [interval]

Options

-a

Lists all TCP/IP connections and their current statuses.

-e

Displays frame statistics for network adapters (can be used with
-s option).

-n

Lists addresses and port numbers as numbers instead of trying to
resolve them using DNS. This is useful if DNS isn't
working properly, and you want to avoid long timeouts when using
netstat.

-o

Displays process ID associated with each listening port.

-s

Displays statistics and connections for all TCP/IP protocols.

-p protocol

When used in conjunction with -s option, displays
statistics for the specified protocol, which can be either TCP, UDP,
ICMP, or IP.

-r

Displays the routing table.

interval

Causes the output to be refreshed each specified number of seconds
until Ctrl-C is pressed.

Examples

Show statistics for Ethernet frames:

netstat -e
Interface Statistics
Received            Sent
Bytes                      48446148        43795441
Unicast packets              195267          207067
Non-unicast packets           12311            6830
Discards                          0               0
Errors                            0               0
Unknown protocols             15400

Show statistics for TCP protocol and the current state of TCP
connections:

netstat -s -p tcp
TCP Statistics
Active Opens                        = 7631
Passive Opens                       = 4689
Failed Connection Attempts          = 269
Reset Connections                   = 380
Current Connections                 = 23
Segments Received                   = 160892
Segments Sent                       = 173884
Segments Retransmitted              = 680
Active Connections
Proto  Local Address      Foreign Address                   State
TCP    test:ldap          test.mtitcanada.com:4208          ESTABLISHED
TCP    test:ldap          test.mtitcanada.com:4216          ESTABLISHED
TCP    test:ldap          test.mtitcanada.com:4229          ESTABLISHED
TCP    test:ldap          test.mtitcanada.com:4233          ESTABLISHED
TCP    test:1110          test.mtitcanada.com:ldap          CLOSE_WAIT
TCP    test:4208          test.mtitcanada.com:ldap          ESTABLISHED
TCP    test:4216          test.mtitcanada.com:ldap          ESTABLISHED
TCP    test:4229          test.mtitcanada.com:ldap          ESTABLISHED
TCP    test:4233          test.mtitcanada.com:ldap          ESTABLISHED
TCP    test:ldap          test.mtitcanada.com:3993          TIME_WAIT
TCP    test:ldap          test.mtitcanada.com:3994          TIME_WAIT
TCP    test:ldap          test.mtitcanada.com:4001          TIME_WAIT
TCP    test:ldap          test.mtitcanada.com:4007          TIME_WAIT
TCP    test:ldap          test.mtitcanada.com:4232          ESTABLISHED
TCP    test:microsoft-ds  test.mtitcanada.com:4009          ESTABLISHED
TCP    test:1026          test.mtitcanada.com:1233          ESTABLISHED
TCP    test:1026          test.mtitcanada.com:1334          ESTABLISHED
TCP    test:1224          test.mtitcanada.com:ldap          CLOSE_WAIT
TCP    test:1227          test.mtitcanada.com:3268          CLOSE_WAIT
TCP    test:1233          test.mtitcanada.com:1026          ESTABLISHED
TCP    test:1298          LEONARDO:netbios-ssn              ESTABLISHED
TCP    test:1300          BACH:1026                         ESTABLISHED
TCP    test:1334          test.mtitcanada.com:1026          ESTABLISHED
TCP    test:3712          test.mtitcanada.com:ldap          CLOSE_WAIT
TCP    test:3936          test.mtitcanada.com:ldap          CLOSE_WAIT
TCP    test:3995          BACH:ldap                         TIME_WAIT
TCP    test:3996          BACH:microsoft-ds                 TIME_WAIT
TCP    test:3998          test.mtitcanada.com:microsoft-ds  TIME_WAIT
TCP    test:4001          test.mtitcanada.com:ldap          TIME_WAIT
TCP    test:4008          BACH:ldap                         TIME_WAIT
TCP    test:4009          test.mtitcanada.com:microsoft-ds  ESTABLISHED
TCP    test:4010          test.mtitcanada.com:epmap         TIME_WAIT
TCP    test:4011          test.mtitcanada.com:1026          TIME_WAIT
TCP    test:4012          test.mtitcanada.com:epmap         TIME_WAIT
TCP    test:4013          test.mtitcanada.com:1026          TIME_WAIT
TCP    test:4232          test.mtitcanada.com:ldap          ESTABLISHED

Notes

• The -o switch is new to WS2003.

• The fields in the output of netstat are:

  Proto

  
  

  
  

  The name of the protocol used for the connection.

  
  

  Local Address

  
  

  
  

  The name (or IP address) and port number (or descriptor) for the
  connection on the local machine. An asterisk means that the port has
  not yet been established.

  
  

  Foreign Address

  
  

  
  

  The name (or IP address) and port number (or descriptor) for the
  connection on the remote machine. An asterisk means that the port has
  not yet been established.

  
  

  State

  
  

  
  

  The connection state (TCP only). This is typically either:

  LISTEN

  
  

  
  

  TCP is waiting for a connection at this port.

  
  

  ESTABLISHED

  
  

  
  

  An active TCP connection has been established at this port.

  If the state is any of the following, the TCP/IP connection is in the
  process of being established or torn down using a three-way TCP
  handshake:

  CLOSED

  CLOSE_WAIT

  FIN_WAIT_1

  FIN_WAIT_2

  LAST_ACK

  SYN_RECEIVED

  SYN_SEND

  TIME_

  WAIT

  
  

  
  

  
  

  
  

See Also

TCP/IP