Is My Computer a Zombie? (and Other Uses for Netstat)
- Netstat Commands and Syntax
- Reading a Netstat Result
- Uses of Netstat
Netstat (NETwork STATe) is an old part of the TCP/IP suite of tools. It's mentioned as far back as 1972, when it was known also as "who is up." Netstat is used to display not completely related information about current network connections. It has many implementations, from Unix to Microsoft Windows, each carrying a subset of the netstat commands.
Netstat is defined in RFC 1147, "The Internet Tool Catalog," as follows:
...a program that accesses network related data structures within the kernel, then provides an ASCII format at the terminal. Netstat can provide reports on the routing table, TCP connections, TCP and UDP "listens," and protocol memory management. MECHANISM Netstat accesses operating system memory to read the kernel routing tables.Netstat provides this information for the moment at which one executes the command. That information might change even as netstat is running.
Netstat Commands and Syntax
Netstat works from a command line and has a variety of switches, as shown in Table 1.
Table 1 Netstat Command Switches
-a |
Displays all connections and listening ports. |
-e |
Displays Ethernet statistics. May be combined with -s. |
-n |
Displays addresses and port numbers in numerical form. |
-p proto |
Displays connections for the protocol specified by proto; proto may be TCP or UDP. If used with the -s option to display per-protocol statistics, proto may be TCP, UDP, or IP. |
-r |
Displays the routing table. |
-s |
Displays per-protocol statistics. By default, statistics are shown for TCP, UDP, and IP; The -p option may be used to specify a subset of the default. |
interval |
Redisplays selected statistics, pausing interval seconds between each display. Press Ctrl+C to stop redisplaying statistics. If omitted, netstat will print the current configuration information once. |
Obviously, you can use the command
netstat /?
from a Microsoft DOS window to get the command set, or you can use the command
man netstat
from a Unix system.
The netstat command is used to obtain information about the current STATe of the NETwork by displaying current network connections.