The –s Switch

The –s Switch
Using the –s switch displays a variety of TCP, UDP, IP, and ICMP protocol statistics. The following is some sample output using this switch.

C:\netstat –s

IP Statistics

Packets Received                   = 17455
Received Header Errors             = 0
Received Address Errors            = 108
Datagrams Forwarded                = 0
Unknown Protocols Received         = 0
Received Packets Discarded         = 0
Received Packets Delivered         = 17346
Output Requests                    = 16374
Routing Discards                   = 255
Discarded Output Packets           = 0
Output Packet No Route             = 0
Reassembly Required                = 2

Reassembly Successful              = 1
Reassembly Failures                = 0
Datagrams Successfully Fragmented  = 0
Datagrams Failing Fragmentation    = 0

Fragments Created                  = 0

ICMP Statistics

                                               Received                      Sent
Messages                                       12                           19
Errors                                            0                                0
Destination Unreachable               0                               7
Time Exceeded                              0                               0
Parameter Problems                      0                                0
Source Quenchs                            0                                0
Redirects                                       0                                0
Echos                                             4                               8
Echo Replies                                 8                                4
Timestamps                                   0                                0
Timestamp Replies                       0                                 0
Address Masks                             0                                 0

Address Mask Replies                  0                                 0


TCP Statistics
Active Opens                                   = 715
Passive Opens                                  = 0
Failed Connection Attempts            = 35
Reset Connections                           = 638
Current Connections                        = 1
Segments Received                          = 15815
Segments Sent                                  = 15806
Segments Retransmitted                   = 61


UDP Statistics
Datagrams Received                        = 573
No Ports                                           = 946
Receive Errors                                 = 0

Datagrams Sent                                = 492

NOTE:

Because the Network+ exam doesn’t cover them, we won’t go into detail on what all these statistics mean. You can probably figure out some of them, such as Packets Received. For details, go to Microsoft’s support website atwww.microsoft.com/support/.

Read More

The –r Switch

The –r Switch
 You use the –r switch to display the current route table for a workstation so that you can see how TCP/IP information is being routed. Figure 4.4 shows sample output using this switch. You
can tell from this output which interface is being used to route to a particular network (useful if computers have multiple NICs).

FIGURE 4 . 4 Sample output of the netstat –r command

Read More

The –e Switch

The –e Switch 
The -e switch displays a summary of all the packets that have been sent over the network interface card (NIC) as of that instant. The two columns in Figure 4.3 show packets coming in as well
as being sent.

FIGURE 4 . 3 Sample output of the netstat –e command

You can use the –e switch to display the following categories of statistics: 
Bytes   The number of bytes transmitted or received since the computer was turned on. This statistic is useful in helping to determine if data is actually being transmitted and received or if the

network interface isn’t doing anything.

Unicast Packets The number of packets sent from or received at this computer. To register in one of these columns, the packet must be addressed directly from one computer to another and the computer’s address must be in either the source or destination address section of the packet.

Non-unicast Packets The number of packets not directly sent from one workstation to
another. For example, a broadcast packet is a non-unicast packet. The number of non-unicast
packets should be smaller than the number of unicast packets. If the number of nonunicast packets is as high as or higher than that of unicast packets, too many broadcast packets are being sent on your network. You should find the source of these packets and make any necessary adjustments.

Discards The number of packets that were discarded by the NIC during either transmission or reception because they weren’t assembled correctly.

Errors The number of errors that occur during transmission or reception. These numbers may indicate problems with the network card. 

Unknown Protocols The number of received packets that the Windows networking stack couldn’t interpret. This statistic shows up only in the Received column because, if the computer
sent them, they wouldn’t be unknown, would they?

    Unfortunately, statistics don’t mean much unless they can be colored with time information. For example, if the Errors column shows 100 errors, is that a problem? It might be if the computer
has been on for only a few minutes. But 100 errors could be par for the course if the computer has been operating for several days. Unfortunately, the netstat utility doesn’t have a way of indicating

how much time has elapsed for these statistics.

Read More