Command library / netstat

Show network connections, listening ports and their owning processes

Lists the machine's TCP/UDP connections and listening ports. In incident response, `-ano` is the classic trio: All connections, Numeric addresses (no slow DNS lookups) and the Owning process ID, which you then map to a program with tasklist. On Linux the modern replacement is `ss`.

Usage

Options and flags

• interval

  seconds between refreshes

• -a

  all connections and listening ports

• -n

  numeric addresses and ports (no name resolution)

• -o

  show the owning process ID (PID)

• -b

  show the executable behind each connection (needs an elevated prompt)

• -e

  Ethernet statistics

• -f

  show fully qualified domain names

• -p PROTO

  show connections for one protocol (tcp, udp, tcpv6, udpv6)

• -r

  display the routing table

• -s

  per-protocol statistics

Examples

• netstat -ano

  Every connection with numeric addresses and PIDs.

• netstat -ano | findstr :4444

  Only lines mentioning port 4444 — e.g. a suspicious listener.

• netstat -an | findstr LISTENING

  Which ports is this machine listening on?

• netstat -r

  Print the routing table.

Common mistakes

Related commands