- [Instructor] netstat is a great program
for diagnosing port and session issues.
On older machines, I can simply run it
from a standard command line,
but on newer versions of Windows,
I'd need administrator privileges.
I'll click on the Start button and type cmd.
I'll then right click on Command Prompt
and choose Run as administrator.
Just typing netstat will begin to slowly give me information
on active connections.
To stop the program, hit Control + C.
I never run netstat by itself,
I always add some additional parameters.
Running netstat -a will also display listening ports.
That was a lot of information, fast.
If I want to slow it down
to a single page of output at a time,
I can add pipe more modifier
to netstat -a | more.
The Enter key we'll move the results down
a single line at a time,
while the space bar moves it down a whole page at a time.
Moving from left to right, it shows the protocol in use,
the local IP in the connection,
then a colon and the local port in use.
Then, I see the remote host and remote ports,
and finally, the state of the connection.
This is a special useful
if I'm troubleshooting a port conflict.
So for example, I'm trying to run a web server on port 80,
but that port is already in use.
netstat -a only shows me listening ports,
but not what has it locked open.
If I add -b, then we'll also indicate the application
using the port.
So, the command will be netstat -ab.
As you can see it lists
the various applications in brackets.
Say now that there are multiple instances
of an application, but only one of them has the port locked.
How do I identify the one offending app?
I do this by adding the -o flag,
which will show the process ID of the program too.
So I type in netstat -abo.
I can then note the process ID,
and reference that in task manager to kill the program.
The next flag I use most often is -n,
which tells netstat to skip DNS resolution
on all of the IPs.
I combine all of this together
on 99% of my netstat queries.
This equates to netstat -abno.
I remember all four letters by thinking of it as ab no,
Do I have abs? Absolutely not.
netstat also allows me to look at the local routing table
on the machine by typing netstat -r.
I can get the exact same information by typing route print.
This gives me IPv4 and v6 routes along with our gateways.
netstat -s | more
gives a lot of good statistical information.
It will tell me about some of the v4 information,
like packets received, errors in those packets,
fragmented packets, and so on.
It will then give me the same information
for IPv6.
It next lists TCP, UDP, and ICNP statistical information.
To supplement the -s information, I can add a -p
and then specify a specific protocol I'm interested in,
like TCP, UDP, or ICNP.
This will allow me to keep rerunning the command
to watch those counters increment.
So now, my command is netstat -sp ICMP.
If I want the command to keep refreshing,
I can add an interval number in seconds at the end.
I'm going to view ICNP statistics every second
by entering netstat -sp ICMP 1.
While this is running, I can open another command prompt
and start a ping so that I can see the counters increment.
Again, this is one of those utilities
that aren't used too frequently,
but this is the only built-in application
that shows port status on a machine.