Display Routing Table
Routing is used to set IP packets first-hop according to their destination. Our system route information can be listed with -r option.
Display Routing Table
As we can see the default route is printed in the first line which IP address is 192.168.122.1 .
How to search netstat details on Windows 10
In addition to displaying all the available statistic information, you can also output only the certain details you need using these steps:
Source: Windows Central (Image credit: Source: Windows Central)
The findstr command isn’t part of the netstat tool. It’s a simple command to search for a text string in a file, but you can use it with many of the netstat commands to make more sense of the information you’re viewing.
The netstat command is available on Windows 10, but you can also find it on Windows Server, Windows 8.x, Windows 7, and older versions. The tool is not exclusive to Windows either, as it’s also available across platforms, including Linux and macOS. Even though the parameters and syntax may be different, they all are very similar.
All the latest news, reviews, and guides for Windows and Xbox diehards.
The netstat (Network Statistics) tool displays statistics for all network connections. It allows you to understand open and connected ports to monitor and troubleshoot networking problems for Windows 10 and apps.
When using the netstat tool, you can list active network connections and listening ports. You can view network adapter and protocol statistics. You can even display the current routing table and much more.
To get started with netstat, use these steps:
(Image credit: Future)
Once you run the command, it will return a list of all active connections in four columns, including:
- Proto: Displays the connection protocol, including TCP or UDP.
- Foreign Address: Shows the remote computer’s IP (or FQDN) address with the port number after the semicolon port name (for instance, https, http, microsoft-ds, wsd).
- State: Shows whether the connection is active (established), if the port has been closed (time_wait) and if the program has not closed the port (close_wait). Other statuses available include closed, fin_wait_1, fin_wait_2, last_ack, listen, syn_received, syn_send, and timed_wait.
СинтаксисПравить
As we know TCP protocol provides reliable data transfer between hosts. TCP implements sessions to provide this reliability. From start to end there are different states in a TCP session. Here the sequence and meaning of TCP states.
- LISTENING means the port is listening but do not have any connection with a remote host
- ESTABLISHED the connection established and communicating with the remote host
- TIME_WAIT the connection is in a wait situations
- CLOSE_WAIT the connection is the closing phase
- CLOSED the connection is closed
- SYN_RECEIVED the sync flag received to start the connection
Ping
Test device connectivity
To test the network connectivity with the ping command on Windows 10, use these steps:
In the command, replace IP-OR-DOMAIN with the actual IP address or domain name of the computer or service you want to test. For example, this command tests the communication between the local device and router: ping 10.1.4.1
If you are dealing with connectivity problems, start pinning the local computer to ensure the network stack is working. Then test the router’s connection to ensure the issue is not in the local network. Then try to ping a website to find out whether there is a problem with the internet connection or the remote host.
Diagnose packet loss activity
The ping command includes many options that you can access with the “ping /?” command, and one of these options is the ability to set the time you want to run the tool, which can come in handy to examine packets lost when you are troubleshooting connectivity problems.
To run the ping command for a specific period, use these steps:
In the command, replace IP-OR-DOMAIN with the actual IP address or domain name of the computer or service you want to test. For example, this command tests the communication between the local device and router: ping 10.1.4.1 -t
Netstat Related Commands
The netstat command is often used with other networking related Command Prompt commands like nslookup, ping, tracert, ipconfig, and others.
- How do I use netstat to look up my proxy?Run ntestat -ban and look through the list for the Process Identifier (PID) of iexplore.exe. This sill show you the proxy port and IP of your system.
- What’s the difference between netstat and nbstat commands?In general, netstat commands are used to display TCP and IP address info, while nbstat commends specifically pertain to NetBIOS statitstics.
Thanks for letting us know!
Get the Latest Tech News Delivered Every Day
Display IPv4 ve IPv6 Statistics
netstat command provides a lot of statistical information about the network stack. These statistics provide detailed metrics about protocols. We can list this statistical information with -s option.
- Packets Received: The total IP packets received.
- Received Header Errors: The total number of headers errors of the received packets.
- Received Address Errors: The total number of address errors of the received packets.
- Unknown Protocols Received: The total number of protocols which is unknown.
- Received Packets Discarded: The total number of packets that are discarded after received.
Show FQDNS for foreign addresses
СсылкиПравить
- Проект OpenNet
- FreeBSD System Manager’s Manual (англ.)
Show listening and non-listening ports
commands can produce a list of all the connections with the listening and bound non-listening ports.
Display Only UDP Protocol
We can also filter and show only UDP protocol ports with -p udp option. Here we provided -a to list UDP too.
Display Only UDP Protocol
As we can see there is no TCP related port or connection information in this example and all UDP ports are currently listening mode without a connection state. This is because the UDP protocol is a connectionless protocol that does not create a session for data transmission.
IPConfig
On Windows 10, ipconfig (Internet Protocol configuration) is among the most common networking tools that allow you to query and show current TCP/IP (Transmission Control Protocol/Internet Protocol) network configuration. The command also includes options to perform different actions, such as refreshing Dynamic Host Configuration Protocol (DHCP) and Domain Name System (DNS) settings.
Display network configuration
To get started with ipconfig on Windows 10, use these steps:
Once you complete the steps, you will have an overview of the PC’s entire TCP/IP configuration.
Refresh network settings
To release and renew the network configuration with Command Prompt, use these steps:
After you complete the steps, the first command will clear the current configuration, and the second command will fetch new settings from the DHCP server to resolve connectivity issues. If the dynamically assigned settings have not expired in the server, it is common to see the same IP address reconfigured on the device.
Refresh DNS settings
To flush and rebuild the current DNS cache entries on Windows 10, use these steps:
Once you complete the steps, the entries stored in the DNS cache of Windows 10 will be deleted and refreshed. Usually, this command will come in handy when you cannot connect to another computer or website using the host or domain name due to outdated information in the local cache.
ПредупрежденияПравить
Таблицы ядра могут изменяться по ходу их обработки программой netstat, что приводит к некорректным или неполным результатам.
Show process ID
command shows all active TCP connections like
, but with the difference that adds a fifth column to display the Process ID (PID) for each connection. The processes available in this view are the same in the “Details” tab of Task Manager, which also reveals the application using the connection.
Route
The route tool displays the routing table that allows Windows 10 to understand the network and communicate with other devices and services. The tool also offers some options to modify and clear the table as needed.
Like the arp tool, you typically do not have to worry about the routing table, but the command-line tool will come in handy when troubleshooting related problems.
To view or flush the routing table available on Windows 10, use these steps:
Once you complete the steps, you will understand the routing table and how to clear the information.
You can also use the “route /?” command to view a list of available options, including options to change networking metrics, specify a gateway, add a new route, and much more. However, modifying these settings is usually not recommended unless you understand how the network works.
Show Interface Statistics
All ports and connections are opened and managed by processes in the operating system. For example, Apache is a web server and uses TCP 80 for listening to HTTP requests. We can list processes id of given connection or port with -o option.
Display Connection or Ports Process ID
We can see that also PID or Process ID is provided which is the current application process ID which listens given port and interface.
ARP
Windows 10 maintains an arp (Address Resolution Protocol) table, which stores IP to Media Access Control (MAC) entries that the system has resolved. The arp tool lets you view the entire table, modify the entries, and use it to determine a remote computer’s MAC address.
Usually, you do not need to worry about MAC addresses, but there are scenarios when this information may come in handy. For example, when troubleshooting network problems at the data link layer (switching) or when restricting access or filtering content through the network for specific devices.
To get started with arp on Windows 10, use these steps:
In the command, make sure to replace IP with the address of the destination. For example, this command reveals the physical address of the 10.1.4.120 destination: arp -a 10.1.4.120
After you complete the steps, you will be able to view the entire arp table and MAC address of a specific IP address.
If you want to know all the available options, use the “arp /?” command to list the available options with their corresponding descriptions.
Display Connection or Ports Process Name
Display Connection or Ports Process Name
We can see from the output that chrome.exe. established a connection with a remote host over https protocol.
Netstat Command Syntax
How to Read Command Syntax
Show numerical form
command displays the addresses and ports in numerical form. For example, 54.230.157.50:443.
Display Information Interactively
If we need to list given options output interactively to monitor the metrics we can use interactive mode. Interactive mode is enabled by providing interval value to print output. This feature does not needs any option we will only provide interval value which is 2 in this case.
Show connections by Protocol
can be used to display connections per-protocol that you have to specify using
next to the command. For example, you can use the
netstat -p tcp
to view a list of TCP connections.
Combine parameters
command, you can also combine the parameters to display various information together for many cases.
For example, the
parameter can also be used with the
parameter to see statistics for each available protocol, and the
parameter can be combined with
command, you append the
parameter, you can display statistics from even more protocols, including
Also, when using more than one parameter, you can combine them with a single
. For example, instead of writing the command
netstat -e -s
, you can write it like this:
If you want to see all the available parameters and additional help, you can always use the
Netstat Command Examples
Here are several examples showing how the netstat command might be used:
Show Active TCP Connections
Here’s an example of what you might see:
As you can see, there were 11 active TCP connections at the time netstat was executed in this example. The only protocol (in the Proto column) listed is TCP, which was expected because we didn’t use -a.
You can also see three sets of IP addresses in the Local Address column—the actual address of 192.168.1.14 and both IPv4 and IPv6 versions of the loopback addresses, along with the port each connection is using. The Foreign Address column lists the FQDN (75.125.212.75 didn’t resolve for some reason) along with that port as well.
Finally, the State column lists the TCP state of that particular connection.
Show Connections and Process Identifiers
Here’s what the computer displayed:
You probably noticed the new PID column. In this case, the PIDs are all the same, meaning the same program on the computer opened these connections.
To determine what program is represented by the PID of 2948 on the computer, open Task Manager to the Processes tab, and note the Image Name listed next to the PID we’re looking for in the PID column.1
While this and the previous example were both run on the same computer, and within just a minute of each other, you can see that the list of active TCP connections is considerably different. This is because your computer is constantly connecting to, and disconnecting from, various other devices on your network and over the internet.
Show Specific Connections Only
The above example is similar to what we’ve already looked at, but instead of displaying all connections, we’re telling the command to show only the connections that are using a specific PID, 28604 in this example.
A similar command could be used to filter out the connections with a CLOSE_WAIT state, by replacing the PID with ESTABLISHED.
Show Protocol-Specific Stats
This is what that netstat command produced for us:
As you can see, various statistics for the TCP protocol are displayed, as are all active TCP connections at the time.
Show Updated Network Stats
Here’s what’s produced on screen:
Various pieces of information, which you can see here and that we listed in the -e syntax above, are displayed.
The command only automatically executed one extra time, as you can see by the two tables in the result. Note the ^C at the bottom, indicating that the Ctrl+C abort command was used to stop the re-running of the command.
ИспользованиеПравить
Команда netstat выводит на экран содержимое различных структур данных, связанных с сетью, в различных форматах в зависимости от указанных опций.
Первая форма команды показывает список активных сокетов (sockets) для каждого протокола. Вторая форма выбирает одну из нескольких других сетевых структур данных. Третья форма показывает динамическую статистику пересылки пакетов по сконфигурированным сетевым интерфейсам; аргумент интервал задает, сколько секунд собирается информация между последовательными показами.
Значение по умолчанию для аргумента система — /unix; для аргумента core в качестве значения по умолчанию используется /dev/kmem.
Show only established connection
We have seen the state in the connection information. You can use below syntax to view all established connections from/to your Windows server.
TCP 192.168.43.15:139 DESKTOP-A0PM5GD:0 LISTENING
TCP 192.168.43.15:52581 ec2-52-1-183-160:https CLOSE_WAIT
TCP 192.168.43.15:52584 ec2-34-227-121-63:https CLOSE_WAIT
Finally, use the TIME_WAIT flag to get information about all the connections that are in TIME_WAIT state.
TCP 192.168.43.15:52590 server-13-33-179-97:https TIME_WAIT
Display Numeric Presentation of Ports and Hostname
Host and ports generally have numeric and text presentations. netstat command by default try to resolve the hostname and port name into text format. If we need to get the host and port numeric information like IP address and the port number we can use -n option.
Display Numeric Presentation of Ports and Hostname
Tracert
To trace the route to a destination with Command Prompt on Windows 10, use these steps:
In the command, replace IP-OR-DOMAIN with the actual IP address or domain name for the destination you want to troubleshoot. For example, this command allows you to view the path the packets are taking to reach Google.com: tracert google.com
In the command, replace IP-OR-DOMAIN with the actual IP address or domain name for the destination you want to troubleshoot and HOP-COUNT for the number of hops you want to trace. For example, this command puts the limit of 5 hops (nodes) to the destination: tracert -h 5 google.com
Once you complete the steps, you will know if the destination is reachable or if there is a networking problem along the way.
Similar to the ping tool, tracert includes several options, which you can view with the “tracert /?” command.
Netstat Command Availability
This command is available from within the Command Prompt in Windows 11, Windows 10, Windows 8, Windows 7, Windows Vista, Windows XP, Windows Server operating systems, and some older versions of Windows, too.
Since netstat is a cross-platform command, it’s also available in other operating systems like macOS and Linux.
The availability of certain netstat command switches and other netstat command syntax may differ from operating system to operating system.
More resources
To start with netstat, let’s see the command that displays all connections.
Type the above command and hit enter. You will see all the active connections from different states as shown below.
You will see a header with Proto, Local Address, Foreign Address, and State. Let’s see brief info about them.
- Proto – defined the protocol type (TCP, UDP, etc..,) of the socket.
- Local Address – displays your computer IP address and port, local end of the socket.
- Foreign Address – displays remote computer that your computer is connected to, the remote end of the socket.
- State – defines the state of the socket (LISTENING, ESTABLISHED, CLOSE_WAIT, TIME_WAIT).
We can filter the connections in different ways. Let’s see them.
Display Only TCP Protocol Statistics
We can only list TCP protocol-related statistics with -s -p tcp option.
Display Only TCP Protocol Statistics
- aPassive Opens will list open connections but not transferred any data recently. In this example, this is 15.
- Reset Connections will list connections that ended with the RST TCP flag.
- Current Connections will list currently opened connection count which is 5 in this example.
- Segments Received will list the count of received TCP segments.
- Segments Sent will list the count of sent TCP segments.
- Segments Retransmitted will list the count of retransmitted TCP segments.
- . www.linuxfoundation.org. Дата обращения: 20 марта 2016. Архивировано 11 июня 2016 года.
- Arch Linux – News: Deprecation of net-tools. www.archlinux.org. Дата обращения: 20 марта 2016. Архивировано 22 июля 2019 года.
Display Only IPv4 Ports and Sockets
We can use -p ip option to filter and show only IPv4 connections. This can be useful generally because the IPv6 protocol is not common.
netstat command provides extensive filtering options according to protocols. We can provide a filter option with -p and protocol name. In this example, we will filter and show only TCP protocol.
As we can see there is no UDP protocol related port and connection information.
Show NetworkDirect connections
NetworkDirect (opens in new tab) is a specification for Remote Direct Memory Access (RDMA), which is a process that allows fast data transfers using the network adapter, freeing up the processor to perform other tasks. Usually, you’ll never use this command unless you’re using the server version of Windows or a high-performance application with a network adapter that supports this feature.
How to use netstat on Windows 10
Once you execute the command, it’ll return a list of all active connections in four columns, including:
- Proto: Shows the connection protocol (TCP or UDP).
- Foreign Address: Lists the remote device’s IP (or FQDN) address with the port number after semicolon port name (for example, https, http, microsoft-ds, wsd).
- State: Indicates where the connection is active (established), the local port has been closed (time_wait), and the program hasn’t closed the port (close_wait). Other status include, closed, fin_wait_1, fin_wait_2, last_ack, listen, syn_received, syn_send, and timed_wait.
Show routing table
command displays the current network routing table that lists all the routes to destinations and matrics known by the device, for IP version 4 and version 6 (if applicable). If the returned information looks familiar, it’s because you can also output the data using the
Display All TCP and UDP Connections with Listening Ports
TCP is the most used protocol for the transmission of packets between different hosts. In a regular usage for a host, there will be a lot of TCP connections in different phases. We can display all these connections with -a option like below.
Display All TCP Connections
- Proto is the protocol the listening port is running. Generally, TCP and UDP are used.
- Local Address is the local or current system IP address and ports number. The IP address and the port number are delimited with the :. 0.0.0.0 means all local IP addresses or network interfaces where 127.0.0.1 means only localhost or current system.
- Foreign Address is the remote IP address which is initiated a connection. Like Local address, IP address and the port number are delimited with the :.
Netsh
On Windows 10, netsh (Network Shell) is a legacy command-line tool that allows you to display and change virtually any network configuration. For instance, you can use the tool to view the current network configurations, manage wireless connections, reset the network stack to fix most common problems, enable or disable the firewall, and a lot more.
To get started with the netsh command-line tool, use these steps:
In the command, change the CONTEXT-COMMAND for the command that includes additional options. For example, this command shows the commands available to manage the firewall with netsh: netsh advfirewall /?
Once you complete the steps, you will know how to navigate the netsh contexts and subcontexts command to manage networking settings.
Reset system network stack
To reset the network stack to resolve common connectivity problems, use these steps:
After you complete the steps, the winsock configuration will reset, hopefully fixing the problems connecting to a network and the internet.
Export and import network configuration
To export the network configuration with netsh on Windows 10, use these steps:
Once you complete the steps, you can open the file with any text editor to view the exported configuration.
To import the network configuration settings with netsh, use these steps:
Enable and disable firewall
To enable the Windows 10 firewall with netsh, use these steps:
Once you complete the steps, the Windows Defender Firewall will enable on the device.
To disable the Windows 10 firewall with netsh, use these steps:
Once you complete the steps, the Windows Defender Firewall will be disabled on the device.
On Windows 10, there are many tools you can use to change settings and troubleshoot networking issues using Command Prompt, PowerShell, and graphical applications. However, in this guide, we only focus on getting you started with some of the most common tools available in Command Prompt.
Show PID used by port number
The above command displays all the connections with PID. Let’s run the command and see how we get the result.
Active Connections
Proto Local Address Foreign Address State PID
TCP 192.168.43.15:50664 40.90.189.152:https ESTABLISHED 3676
TCP 192.168.43.15:50733 40.90.189.152:https ESTABLISHED 10556
We got an extra column called PID. And its the process identifier.
A very handy when you have to find out which PID is using the particular port number.
Display Only ICMP Protocol Statistics
We can list only ICMP related statistics with -s -p icmp option.
Display Only ICMP Protocol Statistics
- Messages: ICMP Messages.
- Errors: ICMP Errors.
- Destination Unreachable: ICMP Destination Unreachable Messages.
Show statistics by Protocol
shows network statistics for all available protocols, including TCP, UDP, ICMP, and IP protocols (version 4 and 6).
NSLookup
The nslookup (Name Server Lookup) tool can show valuable details to troubleshoot and resolve DNS-related issues. The tool includes an interactive and non-interactive modes. However, you will be using the non-interactive mode more often than not, which means you will type the full command to obtain the necessary information.
You can use this command to display the default DNS name and address of the local device and determine the domain name of an IP address or the name servers for a specific node.
To get started with nslookup on Windows 10, use these steps:
In the command, replace the IP-ADDRESS with the address of the remote device. For example, this command looks up the IP address 172.217.165.142 address: nslookup 172.217.165.142
In the command, replace the DOMAIN-NAME with the address of the remote device. For example, this command looks up the IP address Google.com address: nslookup google.com
After you complete the steps, depending on the command, you will know whether the device has a DNS resolver and the IP address or domain and vice versa of the remote host.
Show routing information
If you use the above command, then you see the info about routing as shown below.
Show active and inactive connections
command displays all active and inactive connections, and the TCP and UDP ports the device is currently listening.
How to use netstat parameters on Windows 10
The tool also includes several parameters that you can use in Command Prompt to display different information about the network connections.
Выдаваемая информацияПравить
Для каждого активного сокета показывается протокол, размер очередей приема и получения (в байтах), локальный и удаленный адрес, а также внутреннее состояние протокола.
Символьный формат, обычно используемый для показа адресов сокетов, — это либо:
если имя хоста указано, либо:
если адрес сокета задает сеть, но не конкретный хост. Имена хостов и сетей берутся из соответствующих записей в файле /etc/hosts или /etc/networks.
Если имя сети или хоста для адреса неизвестно (или если указана опция -n), адрес показывается числами. Не указанные или «обобщенные» адреса и порты показываются как «*». Подробнее о соглашениях по именованию в Internet см. страницу справочного руководства inet.
Для сокетов TCP допустимы следующие значения состояния:
Сетевые структуры данных
Показываемые данные зависят от выбора опции, -i или -r. Если указаны обе опции, netstat выберет -i.
Показ таблицы маршрутизации
Таблица маршрутизации показывает все имеющиеся маршруты (routes) и статус каждого из них. Каждый маршрут состоит из целевого хоста или сети и шлюза (gateway), который используется для пересылки пакетов. Столбец flags (флаги) показывает статус маршрута (U, если он включен), ведёт ли маршрут на шлюз (G), был ли маршрут создан динамически при помощи перенаправления (D), и используется ли адрес индивидуального хоста (H) вместо адреса сети. Например, интерфейс закольцовывания (loopback transport provider) lo0 всегда имеет флаг H.
Прямые маршруты создаются для каждого интерфейса, подключенного к локальному хосту; поле gateway (шлюз) для таких записей показывает адрес выходного интерфейса.
Столбец refcnt показывает текущее количество активных использований для маршрута. Протоколы, ориентированные на соединение, обычно используют в ходе соединения один маршрут, тогда как протоколы без соединения получают маршрут для каждой посылки одному и тому же адресату.
Столбец use показывает количество пакетов, посланных по маршруту.
Столбец interface показывает сетевой интерфейс, используемый маршрутом.
Суммарная статистика передачи данных
Когда задан аргумент интервал, netstat показывает таблицу суммарной статистической информации о переданных пакетах, ошибках и коллизиях. Первая показываемая строка данных, а также каждая последующая 24-я строка содержит суммарную статистическую информацию с момента последней перезагрузки системы. Каждая последующая строка показывает данные, накопленные за очередной указанный в командной строке интервал с момента последнего показа.
Display Only IPv6 Ports and Sockets
We can use -p ipv6 option to filter and show only IPv6 connections about the netstat command.
Show network adapter statistics
command generates a statistic of the network interface, which shows information like the number of bytes, unicast and non-unicast sent and received packets. You can also see discarded packets and errors and unknown protocols, which can you troubleshoot networking problems.
Show Fully Qualified Domain Name of foreign address (remote host)
Note: you can combine findstr syntax to show precise results like below.
The above command will filter the connections and displays only established connections. Let’s see an example.
Show statistics of all protocols
Useful when you have to find out for any received header error, received address error, discarded packet, etc. It will list out statistics from IPv4, IPv6, ICMPv4, ICMPv6, TCP, UDP, etc.
You will see the statistics of all protocols as shown below.
To find out any errors quickly you can use syntax.
The above command filters all the errors from statistics of all protocols.
Show offload state connections
command generates a list of the current connection offload state. The offload state refers to the TCP Chimney Offload (opens in new tab), which is a feature that transfers the network workload from the processor to the network adapter during data transmissions. The “InHost” value indicates that offloading isn’t enabled, and the “Offload” means that the feature is transferring the workload to the network adapter. (This feature is only present on supported network adapters.)
Display Fully Qualified Domain Name
Normally netstat will list hostnames in a simple manner and in a fast way. It can skip some domain names too. We can for netstat to print fully qualified domain names with -f option.
Display Fully Qualified Domain Name
We can see that only resolved DNS names or fully qualified domain names are shown like oracle.com.
Display Ethernet Statistics
Ethernet or MAC generally used for the same meaning. Ethernet is a Layer 2 protocol used to communicate in our LAN with other hosts and mostly with a gateway that is used to access other networks or the internet. We can list detailed information about the ethernet protocol. We will use -e option to list ethernet statistics.
Display Ethernet Statistics
- Received column is used to specify the received sizes.
- Sent column is used to specify the sent sizes.
- Bytes is used successfully completed transfers.
- Unicast packets generally related to the UDP protocol where there is no connection and session management.
- Non-unicast
- Discards is the packets that are discarded because of the problems.
- Errors show the sizes of the packets where errors occurred.
- Unknown protocols show the protocols currently unknown by the TCP/IP stack.
Show connection template
command displays TCP connections templates for all connections.
