The netstat command can be used to monitor and troubleshoot a variety of network issues, and in this post, you’ll learn how to use it on Windows 10.
Netstat (network statistics) has been there for a long time on Windows 10, and it’s a command-line tool that displays statistics for all network connections in Command Prompt. It allows you to monitor and troubleshoot networking problems for your system or apps by understanding open and connected ports.
You may list active networks (incoming and outgoing) connections and listening ports with this utility. You may see network adapter information as well as protocol statistics (such as IPv4 and IPv6). You can also see the current routing table, among other things.
We’ll show you how to use the netstat tool to check connections and find open and connected network ports in this Windows 10 article.
On Windows 10, here’s how to use netstat.
Follow these steps to get started with netstat:
- Start the programme.
- Right-click the top result in the search for Command Prompt and choose Run as administrator.
- To see all active TCP connections, use the following command and press Enter.
netstat
4. (Optional) Instead of trying to figure out the names, type the following command to see active connections with numeric IP addresses and port numbers:
netstat -n
5. (Optional) To refresh the information at a given interval, type the following command and hit Enter:
netstat -n INTERVALMake careful you replace INTERVAL with the number of seconds you want to redisplay the information in the command.
This example performs a five-second refresh of the command in question:
netstat -n 5
Quick tip: When utilizing the interval parameter, you can end the command in the console by pressing the Ctrl + C keyboard shortcut.
When you use the command, it will return a four-column list of all active connections, including:
Proto: Displays the connection protocol (TCP or UDP).
Local Address: Displays the computer’s IP address, followed by a semicolon and the connection’s port number. The local IPv6 address is indicated by the double-semicolon inside brackets, and “0.0.0.0” also refers to the local address.
Foreign Address: Lists the IP (or FQDN) address of the remote device, with the port number after the semicolon port name (for example, https, http, microsoft-ds, wsd).
State: Displays where the connection is active (established), the local port has been closed (time_wait), and the program hasn’t closed the port (close_wait). Other status include, closed, fin_wait_1, fin_wait_2, last_ack, listen, syn_received, syn_send, and timed_wait.
On Windows 10, how do I utilise the netstat parameters?
The application also offers a number of parameters that you may use in Command Prompt to display various network connection details.
Show connections that are active and those that are inactive.
The netstat -a command displays all active and inactive connections as well as the device’s current TCP and UDP ports.
Display information that is executable
Each connection’s executables (applications) are listed with the netstat -b command. Applications may open multiple connections at times.
Displays Stats for network adapters
The netstat -e command provides a network interface statistic that includes information such as the number of bytes, unicast and non-unicast packets delivered and received, and more. In addition, you can observe discarded packets, errors, and unknown protocols, which might help you debug networking issues.
Displays FQDNS for foreign addresses
The netstat -f command shows the fully qualified domain name (FQDN) for foreign addresses. For example, “server-54-230-157-50.otp50.r.cloudfront.net:http” instead of “server-54-230-157-50:http” or “54.230.157.50”.
Displays numerical form
The netstat -n command displays the addresses and ports in numerical form. For example, 54.230.157.50:443.
Display the process ID
The netstat -o command, like netstat, displays all current TCP connections but adds a fifth column to display the Process ID (PID) for each connection. The processes visible in this view are the same as those in Task Manager’s “Details” tab, which additionally shows the program that is using the connection.
Displays connections by Protocol
You can use netstat -p to display connections per-protocol if you specify tcp, udp, tcpv6, or udpv6 next to the command. To see a list of TCP connections, for example, type netstat -p tcp.
Displays listening and non-listening ports
The netstat -q commands can produce a list of all the connections with the listening and bound non-listening ports.
Displays statistics by Protocol
The netstat -s shows network statistics for all available protocols, including TCP, UDP, ICMP, and IP protocols (version 4 and 6).
Display the routing table
For IP versions 4 and 6, the netstat -r tool displays the current network routing table, which lists all the routes to destinations and matrices known by the device (if applicable). If the information returned looks familiar, it’s because the route print command can also output the data.
Offload state links are shown.
The netstat -t command displays the current connection offload state as a list. The TCP Chimney Offload function, which moves network workload from the processor to the network adapter during data transmissions, is referred to as the offload state. Offloading isn’t enabled with the “InHost” value, and the “Offload” value indicates that the functionality is shifting the workload to the network adapter. (This feature is only available on network adapters that are supported.)
NetworkDirect connections are displayed.
A list of NetworkDirect connections shared endpoints, and listeners can be found with the netstat -x command on Windows 10.
Remote Direct Memory Access (RDMA) is a mechanism that allows quick data transfers utilizing the network adapter, freeing up the processor to handle other activities. NetworkDirect is a specification for RDMA. Unless you’re using the server version of Windows or a high-performance program with a network adapter that supports this capability, you’ll almost never use this command.
Show connection template
For all connections, the netstat -y program provides TCP connection templates.
Combine parameters
In many circumstances, while using the netstat command, you can combine the parameters to display many pieces of information at once.
The -e parameter, for example, can be paired with the -s parameter to display statistics for each accessible protocol, and the -o parameter can be used with the -a, -n, and -p parameters as needed.
When you include the s parameter to the netstat -p command, you can see statistics for even more protocols, such as icmp, ip, icmpv6, and ipv6.
When utilising multiple parameters, you can also use a single – to combine them. For example, instead of writing netstat -e -s, you could write netstat -es.
You may always use the netstat /? command to check all of the available parameters as well as further guidance.
How to look for netstat information in Windows 10
You can output only the specific details you require using these steps, in addition to presenting all of the available statistic information:
- Start the programme.
- Right-click the top result in the search for Command Prompt and choose Run as administrator.
- To list all the connections with the state set to LISTENING, type the following command and press Enter:
netstat -q | findstr STRINGMake careful to replace STRING with the information you wish to list in the command. In addition, the findstr option is case-sensitive, which means you must enter the string you want to find exactly as it is written.
This example displays all connections with the status “LISTENING” set.
netstat -q | findstr LISTENING
The following example displays all connections from a foreign server FQDN, in this case Amazon:
netstat -f | findstr amazonAs you can see, only a portion of the string is required to yield a result.
The netstat utility does not provide the findstr command. It’s a simple command that searches a file for a text string, but it may be combined with many other netstat commands to help you understand what you’re seeing.
The netstat command is present in Windows 10, as well as Windows Server, Windows 8.x, Windows 7, and previous versions. The program isn’t only for Windows users; it’s also available for Linux and macOS users. Despite the fact that the arguments and syntax varies, they are all fairly similar.
