Using the netstat Utility

Using the netstat Utility

Using netstat is a great way to see the TCP/IP connections (both inbound and outbound) on your machine. You can also use it to view packet statistics (similar to the MONITOR.NLM utility
on a NetWare server console), such as how many packets have been sent and received, the number of errors, and so on.
When used without any options, netstat produces output similar to that in Figure 4.1, which shows all the outbound TCP/IP connections (in the case of Figure 4.1, a Web connection).
The netstat utility, used without any options, is particularly useful in determining the status of outbound Web connections.
The Proto column lists the protocol being used. Because this is a Web connection, the protocol is TCP. The Local Address column lists the source address and the source port (source socket). In this case, default indicates that the PC has no NetBIOS name configured and refers to the local IP address, which is followed by the source ports, four separate dynamically registered
TCP ports used to open four separate TCP connections. The Foreign Address item for all four connections is 204.153.163.2:80, indicating that for all four connections, the address of the destination machine is 204.153.163.2 and that the destination port is TCP port 80 (in other words, HTTP for the Web). The State column indicates the status of each connection. This column
shows statistics only for TCP connections because UDP establishes no virtual circuit to the remote device. Usually, this column indicates ESTABLISHED once a TCP connection between
your computer and the destination computer is established.



FIGURE 4 . 1 Output of the netstat command without any switches

NOTE:
If the address of either your computer or the destination computer can be found in the HOSTS file on your computer, the destination computer’s name, rather than the IP address, will show up in either the Local Address or Foreign Address column.

The output of the netstat utility depends on the switch. You can use the following :

•  –a
• –e
• –r
• –s
• –n
• –p

Simply type netstat followed by a space and then the switch. Some switches have options, but the syntax is basically the same. Note the UNIX style of the switches, where the hyphen must be included. This is common in Microsoft operating systems for TCP/IP utilities, which stem from original use in UNIX systems.

Read More

The –a Switch

The –a Switch
When you use the –a switch, the netstat utility displays all TCP/IP connections and all User Datagram Protocol (UDP) connections. Figure 4.2 shows a sample output produced by the netstat –a command.
The last two entries in Figure 4.2 show a protocol type of UDP and the source port nicknames of nbname and nbdatagram, which are the well-known port numbers of 137 and 138, respectively. These port numbers are commonly seen on networks that broadcast the NetBIOS name of a workstation on the TCP/IP network. You can tell that this is a broadcast because the destination address is listed as *:* (meaning “any address, any port”).  

FIGURE 4 . 2 Sample output of the netstat –a command

NOTE:

The State column has no entry because UDP is not a connection-oriented protocol and, therefore, has no connection state.

The most common use for the –a switch is to check the status of a TCP/IP connection that appears to be hung. You can determine if the connection is simply busy or is actually hung and no longer responding.

Read More