Solved

NETSTAT Question

Posted on 2004-09-14
4
1,427 Views
Last Modified: 2008-02-01
Hi,

If I do the following:

Check who is ports/connected:
1.  Open START>RUN>CMD
2.  Type this: "netstat -a" and Press ENTER
3.  To Save who is connected, you could save to a text file: netstat -an
|find /i "listening" > c:\currentcons.txt

...then I get a result list like below....what lines tell me who is connected to the computer?  I want to use this command on an IIS server to see who is connected.  What tells me who is connected or if anyone is connected?

C:\>netstat -a

Active Connections

  Proto  Local Address          Foreign Address        State

  TCP    thaltin-p-mkt:4294     thaltin-p-mkt.dex.dexmedia.com:0  LISTENING
  TCP    thaltin-p-mkt:4306     thaltin-p-mkt.dex.dexmedia.com:0  LISTENING
  TCP    thaltin-p-mkt:4576     thaltin-p-mkt.dex.dexmedia.com:0  LISTENING
  TCP    thaltin-p-mkt:4827     thaltin-p-mkt.dex.dexmedia.com:0  LISTENING
  TCP    thaltin-p-mkt:dex_dev1  thaltin-p-mkt.dex.dexmedia.com:0  LISTENING
  TCP    thaltin-p-mkt:ms-sql-s  localhost:1151         TIME_WAIT
  TCP    thaltin-p-mkt:1437     localhost:1151         TIME_WAIT
  TCP    thaltin-p-mkt:1440     localhost:1151         TIME_WAIT
  TCP    thaltin-p-mkt:netbios-ssn  thaltin-p-mkt.dex.dexmedia.com:0  LISTENING
  TCP    thaltin-p-mkt:netbios-ssn  dexdenp01.dex.uswest.com:4706  ESTABLISHED
  TCP    thaltin-p-mkt:3044     denpds01.dexmedia.com:402  ESTABLISHED
  TCP    thaltin-p-mkt:4290     thaltin-p-mkt.dex.dexmedia.com:0  LISTENING
  TCP    thaltin-p-mkt:4290     denpvps02.dexmedia.com:netbios-ssn  ESTABLISHED
  TCP    thaltin-p-mkt:4294     dexdenpdc06.dexmedia.com:17047  ESTABLISHED
  UDP    thaltin-p-mkt:401      *:*
  UDP    thaltin-p-mkt:402      *:*
  UDP    thaltin-p-mkt:407      *:*
  UDP    thaltin-p-mkt:microsoft-ds  *:*
  UDP    thaltin-p-mkt:isakmp   *:*
  UDP    thaltin-p-mkt:1026     *:*
  UDP    thaltin-p-mkt:1027     *:*
  UDP    thaltin-p-mkt:1028     *:*
  UDP    thaltin-p-mkt:4609     *:*
  UDP    thaltin-p-mkt:4633     *:*
  UDP    thaltin-p-mkt:ntp      *:*
  UDP    thaltin-p-mkt:netbios-ns  *:*
  UDP    thaltin-p-mkt:netbios-dgm  *:*
  UDP    thaltin-p-mkt:1900     *:*

C:\>THANKS!!
0
Comment
Question by:RenitlahHelp
  • 2
  • 2
4 Comments
 
LVL 16

Accepted Solution

by:
InteraX earned 500 total points
Comment Utility
Hi RenitlahHelp,

Anything with established at the end of the line is a current connection.
Anything with time_wait at the end of the line is a recent connection.
Anything listening is not connected.
If you type netstat -a -o it will tell you which PID owns the connection aswell.

You can then type tasklist /svc to see which processes and dll's are creating the connections.

Good Luck
;-)
0
 
LVL 8

Expert Comment

by:RevelationCS
Comment Utility
http://www.microsoft.com/windows2000/techinfo/reskit/en-us/default.asp?url=/windows2000/techinfo/reskit/en-us/cnet/cnbd_trb_dnke.asp

******************************************************************
Netstat
Displays protocol statistics and current TCP/IP network connections. This command is available only if the TCP/IP protocol has been installed.

netstat [-a] [-e] [-n] [-s] [-p protocol] [-r] [interval]

Parameters

-a

Displays all connections and listening ports. Server connections are normally not shown.

-e

Displays Ethernet statistics. This may be combined with the -s option.

-n

Displays addresses and port numbers in numerical form (rather than attempting name look-ups).

-s

Displays per-protocol statistics. By default, statistics are shown for TCP, UDP, ICMP, and IP. The -p option can be used to specify a subset of the default.

-p protocol

Shows connections for the protocol specified by protocol; protocol can be tcp or udp. If used with the -s option to display per-protocol statistics, protocol can be tcp, udp, icmp, or ip.

-r

Displays the contents of the routing table.

interval

Redisplays selected statistics, pausing interval seconds between each display. Press CTRL+B to stop redisplaying statistics. If this parameter is omitted, netstat prints the current configuration information once.

******************************************************************
0
 
LVL 8

Expert Comment

by:RevelationCS
Comment Utility
Inter,

what OS are you referring to here?
0
 
LVL 16

Expert Comment

by:InteraX
Comment Utility
RenitlahHelp,

Oops. Sorry. Too used to Win XP. However the explantion of the Established and Time_Wait statements in the output are still the same.

The Time_Wait state will exist for 4 minutes. This can be adjusted in the registry.
0

Featured Post

Complete Microsoft Windows PC® & Mac Backup

Backup and recovery solutions to protect all your PCs & Mac– on-premises or in remote locations. Acronis backs up entire PC or Mac with patented reliable disk imaging technology and you will be able to restore workstations to a new, dissimilar hardware in minutes.

Join & Write a Comment

NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
Veeam Backup & Replication has added a new integration – Veeam Backup for Microsoft Office 365.  In this blog, we will discuss how you can benefit from Office 365 email backup with the Veeam’s new product and try to shed some light on the needs and …
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
Access reports are powerful and flexible. Learn how to create a query and then a grouped report using the wizard. Modify the report design after the wizard is done to make it look better. There will be another video to explain how to put the final p…

771 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now