DOS command encyclopedia: Detailed explanation of Netstat command

Shows active TCP connections, ports the computer is listening on, Ethernet statistics, IP routing tables, IPv4 statistics (for IP, ICMP, TCP and UDP protocols) and IPv6 statistics (for IPv6, ICMPv6, TCP over IPv6 and UDP protocol over IPv6). When used without arguments, netstat displays active TCP connections.

MS-DOS command syntax

netstat [-a] [-e] [-n] [-o] [-p Protocol] [-r] [-s] [Interval]

MS-DOS command parameters

-a

Shows all active TCP connections and the TCP and UDP ports your computer is listening on.

-e

Displays Ethernet statistics, such as the number of bytes sent and received, and the number of packets. This parameter can be used in conjunction with -s.

-n

displays active TCP connections, however, only represents the address and port number in numerical form, and does not attempt to determine the name.

-o

Shows active TCP connections and includes the process ID (PID) of each connection. PID-based applications can be found on the Processes tab in Windows Task Manager. This parameter can be used with -a, -n, and -p.

-p Protocol

Displays the connections of the protocol specified by Protocol. In this case, Protocol can be tcp, udp, tcpv6, or udpv6. If this parameter is used with -s to display statistics by protocol, Protocol can be tcp, udp, icmp, ip, tcpv6, udpv6, icmpv6, or ipv6.

-s

Show statistics by protocol. By default, statistics are displayed for TCP, UDP, ICMP, and IP protocols. If the IPv6 protocol for Windows XP is installed, statistics are displayed for TCP over IPv6, UDP over IPv6, ICMPv6, and the IPv6 protocol. The protocol set can be specified using the -p parameter.

-r

Display the contents of the IP routing table. This parameter is equivalent to the route print command.

Interval

Redisplay the selected information every Interval seconds. Press CTRL+C to stop redisplaying statistics. If this parameter is omitted, netstat will print the selected information only once.

/?

Show help in command prompt.

MS-DOS Command Notes

Arguments used with this command must be prefixed with a hyphen (-) rather than a slash (/).

Netstat provides the following statistics:

Proto

The name of the protocol (TCP or UDP).

Local Address

The IP address of the local computer and the port number in use. If you do not specify the -n parameter, the local computer name corresponding to the IP address and port name is displayed. If the port has not yet been established, the port is shown with an asterisk (*).

Foreign Address

The IP address and port number of the remote computer connected to this slot. If the -n parameter is not specified, the name corresponding to the IP address and port is displayed. If the port has not yet been established, the port is shown with an asterisk (*).

(state)

Indicates the status of the TCP connection. Possible statuses are as follows:

CLOSE_WAIT

CLOSED

ESTABLISHED

FIN_WAIT_1

FIN_WAIT_2

LAST_ACK

LISTEN

SYN_RECEIVED

SYN_SEND

TIMED_WAIT

For information on TCP connection status, see RFC 793.

This command is only available if the Internet Protocol (TCP/IP) protocol is installed as a component of the network adapter properties in Network Connections.

MS-DOS Command Example

To display Ethernet statistics and statistics for all protocols, type the following command:

netstat -e -s

To display statistics for only TCP and UDP protocols, please Type the following command:

netstat -s -p tcp udp

To display active TCP connections and process IDs every 5 seconds, type the following command:

nbtstat -o 5

To display it numerically Active TCP connections and process IDs, type the following command:

nbtstat -n -o