Solved

NETSTAT Question

Posted on 2004-09-14
4
1,443 Views
Last Modified: 2008-02-01
Hi,

If I do the following:

Check who is ports/connected:
1.  Open START>RUN>CMD
2.  Type this: "netstat -a" and Press ENTER
3.  To Save who is connected, you could save to a text file: netstat -an
|find /i "listening" > c:\currentcons.txt

...then I get a result list like below....what lines tell me who is connected to the computer?  I want to use this command on an IIS server to see who is connected.  What tells me who is connected or if anyone is connected?

C:\>netstat -a

Active Connections

  Proto  Local Address          Foreign Address        State

  TCP    thaltin-p-mkt:4294     thaltin-p-mkt.dex.dexmedia.com:0  LISTENING
  TCP    thaltin-p-mkt:4306     thaltin-p-mkt.dex.dexmedia.com:0  LISTENING
  TCP    thaltin-p-mkt:4576     thaltin-p-mkt.dex.dexmedia.com:0  LISTENING
  TCP    thaltin-p-mkt:4827     thaltin-p-mkt.dex.dexmedia.com:0  LISTENING
  TCP    thaltin-p-mkt:dex_dev1  thaltin-p-mkt.dex.dexmedia.com:0  LISTENING
  TCP    thaltin-p-mkt:ms-sql-s  localhost:1151         TIME_WAIT
  TCP    thaltin-p-mkt:1437     localhost:1151         TIME_WAIT
  TCP    thaltin-p-mkt:1440     localhost:1151         TIME_WAIT
  TCP    thaltin-p-mkt:netbios-ssn  thaltin-p-mkt.dex.dexmedia.com:0  LISTENING
  TCP    thaltin-p-mkt:netbios-ssn  dexdenp01.dex.uswest.com:4706  ESTABLISHED
  TCP    thaltin-p-mkt:3044     denpds01.dexmedia.com:402  ESTABLISHED
  TCP    thaltin-p-mkt:4290     thaltin-p-mkt.dex.dexmedia.com:0  LISTENING
  TCP    thaltin-p-mkt:4290     denpvps02.dexmedia.com:netbios-ssn  ESTABLISHED
  TCP    thaltin-p-mkt:4294     dexdenpdc06.dexmedia.com:17047  ESTABLISHED
  UDP    thaltin-p-mkt:401      *:*
  UDP    thaltin-p-mkt:402      *:*
  UDP    thaltin-p-mkt:407      *:*
  UDP    thaltin-p-mkt:microsoft-ds  *:*
  UDP    thaltin-p-mkt:isakmp   *:*
  UDP    thaltin-p-mkt:1026     *:*
  UDP    thaltin-p-mkt:1027     *:*
  UDP    thaltin-p-mkt:1028     *:*
  UDP    thaltin-p-mkt:4609     *:*
  UDP    thaltin-p-mkt:4633     *:*
  UDP    thaltin-p-mkt:ntp      *:*
  UDP    thaltin-p-mkt:netbios-ns  *:*
  UDP    thaltin-p-mkt:netbios-dgm  *:*
  UDP    thaltin-p-mkt:1900     *:*

C:\>THANKS!!
0
Comment
Question by:RenitlahHelp
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
4 Comments
 
LVL 16

Accepted Solution

by:
InteraX earned 500 total points
ID: 12056015
Hi RenitlahHelp,

Anything with established at the end of the line is a current connection.
Anything with time_wait at the end of the line is a recent connection.
Anything listening is not connected.
If you type netstat -a -o it will tell you which PID owns the connection aswell.

You can then type tasklist /svc to see which processes and dll's are creating the connections.

Good Luck
;-)
0
 
LVL 8

Expert Comment

by:RevelationCS
ID: 12056034
http://www.microsoft.com/windows2000/techinfo/reskit/en-us/default.asp?url=/windows2000/techinfo/reskit/en-us/cnet/cnbd_trb_dnke.asp

******************************************************************
Netstat
Displays protocol statistics and current TCP/IP network connections. This command is available only if the TCP/IP protocol has been installed.

netstat [-a] [-e] [-n] [-s] [-p protocol] [-r] [interval]

Parameters

-a

Displays all connections and listening ports. Server connections are normally not shown.

-e

Displays Ethernet statistics. This may be combined with the -s option.

-n

Displays addresses and port numbers in numerical form (rather than attempting name look-ups).

-s

Displays per-protocol statistics. By default, statistics are shown for TCP, UDP, ICMP, and IP. The -p option can be used to specify a subset of the default.

-p protocol

Shows connections for the protocol specified by protocol; protocol can be tcp or udp. If used with the -s option to display per-protocol statistics, protocol can be tcp, udp, icmp, or ip.

-r

Displays the contents of the routing table.

interval

Redisplays selected statistics, pausing interval seconds between each display. Press CTRL+B to stop redisplaying statistics. If this parameter is omitted, netstat prints the current configuration information once.

******************************************************************
0
 
LVL 8

Expert Comment

by:RevelationCS
ID: 12056166
Inter,

what OS are you referring to here?
0
 
LVL 16

Expert Comment

by:InteraX
ID: 12056221
RenitlahHelp,

Oops. Sorry. Too used to Win XP. However the explantion of the Established and Time_Wait statements in the output are still the same.

The Time_Wait state will exist for 4 minutes. This can be adjusted in the registry.
0

Featured Post

Ransomware-A Revenue Bonanza for Service Providers

Ransomware – malware that gets on your customers’ computers, encrypts their data, and extorts a hefty ransom for the decryption keys – is a surging new threat.  The purpose of this eBook is to educate the reader about ransomware attacks.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Cursor typing problems 5 59
File not visible when another user accessing on a file server. 4 442
Print Server: NT to 2008 10 598
Windows 2000 undelete (free program?) 6 440
NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
After hours on line I found a solution which pointed to the inherited Active Directory permissions . You have to give/allow permissions to the "Exchange trusted subsystem" for the user in the Active Directory...
Nobody understands Phishing better than an anti-spam company. That’s why we are providing Phishing Awareness Training to our customers. According to a report by Verizon, only 3% of targeted users report malicious emails to management. With compan…
Finds all prime numbers in a range requested and places them in a public primes() array. I've demostrated a template size of 30 (2 * 3 * 5) but larger templates can be built such 210  (2 * 3 * 5 * 7) or 2310  (2 * 3 * 5 * 7 * 11). The larger templa…

752 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question