Command Reference
netstat
Gnojo Analysis
Understanding netstat
What This Command Does
Displays active TCP/UDP connections, listening ports, routing table, interface statistics, and per-protocol statistics to help diagnose network and port usage on Windows.
When to Use It
Use netstat when troubleshooting networking issues and you need information that can help narrow down the cause.
What to Look For
-a
Shows all connections and listening ports. Essential when verifying whether a service is actually listening.
-n
Disables DNS/FQDN lookups and shows numeric addresses. Avoids delays and makes scripting/filtering predictable.
-o
Displays the owning process ID. Critical for correlating ports to processes for remediation.
-b
Displays the executable creating each connection or listener. Often requires elevation; invaluable for identifying the exact binary.
Permissions
Administrator access is not normally required for this command.
Risk and impact
Read-only command; however, it may reveal sensitive process names, IPs, and ports in logs or screenshots. Use -n to avoid unnecessary DNS lookups on production systems.
Summary
Displays active TCP/UDP connections, listening ports, routing table, interface statistics, and per-protocol statistics to help diagnose network and port usage on Windows.
Syntax
netstat [-a] [-b] [-e] [-f] [-n] [-o] [-p Proto] [-q] [-r] [-s] [-t] [-x] [-y] [Interval]Examples
netstat -anoLists all connections and listening ports with numeric addresses and the owning process ID (PID). Useful to identify which PID has a port open.
netstat -an | findstr :80Filters numeric output to show connections/listeners on TCP/UDP port 80. Helpful for confirming HTTP port usage or conflicts.
netstat -abnoShows all connections/listeners with the executable (-b), numeric addresses (-n), and PID (-o). Requires elevation; useful for mapping ports directly to binaries.
netstat -rDisplays the IP routing table (same as route print). Use this to verify default gateways and route precedence.
netstat -s -p tcpShows TCP protocol statistics only. Useful for spotting retransmissions, resets, and overall TCP health.
netstat -afDisplays all connections and listening ports and attempts to resolve foreign addresses to FQDNs. Helpful when you need human-readable remote endpoints.
Permissions
Administrator required: No
Most netstat output is available to standard users. Options like -b (executable mapping) often require an elevated Command Prompt. Some entries may show 'Can not obtain ownership information' without admin rights or if the process exits quickly.
Risk and Impact
Risk level: Low
Changes the system: No
Read-only command; however, it may reveal sensitive process names, IPs, and ports in logs or screenshots. Use -n to avoid unnecessary DNS lookups on production systems.
Supported Platforms
Important Output Fields
-a
Shows all connections and listening ports. Essential when verifying whether a service is actually listening.
-n
Disables DNS/FQDN lookups and shows numeric addresses. Avoids delays and makes scripting/filtering predictable.
-o
Displays the owning process ID. Critical for correlating ports to processes for remediation.
-b
Displays the executable creating each connection or listener. Often requires elevation; invaluable for identifying the exact binary.
-p Proto
Filters by protocol (TCP, UDP, TCPv6, UDPv6, IP, IPv6, ICMP, ICMPv6). Reduces noise and focuses analysis.
Proto
Output column indicating protocol (TCP or UDP). Helps separate connection-oriented vs connectionless traffic.
Local Address
IP and port bound locally (0.0.0.0 or [::] means all interfaces). Key for exposure/scope of a listening service.
Foreign Address
Remote endpoint IP/port. Identifies who you are connected to or receiving from.
State
TCP connection state (LISTENING, ESTABLISHED, TIME_WAIT, CLOSE_WAIT, etc.). Indicates lifecycle/health of connections.
PID
Owning process identifier (with -o). Needed to map ports to processes via tasklist or Task Manager.
-r
Shows the routing table. Useful for validating default route and specific network paths.
-s
Displays per-protocol statistics. Helps quantify errors, resets, and packet counts.
-t
Shows TCP offload state. Useful when troubleshooting NIC offload/acceleration issues.
-q
Displays all connections, listening ports, and bound non-listening TCP ports. Helps spot sockets in a bound state without a listener.
Common Errors
The requested operation requires elevation.
Occurs when using options like -b (show executable) without an elevated Command Prompt. Run as Administrator.
Can not obtain ownership information.
Seen with netstat -b when the tool cannot map a socket to an executable (insufficient rights or the process exited). Try elevation and rerun promptly.
Slow output or long pauses.
Name resolution delays when not using -n or when using -f to resolve FQDNs. Use -n to disable lookups or ensure DNS is responsive.
Invalid protocol specified with -p.
Using an unsupported protocol token (e.g., netstat -p foo). Use one of: TCP, UDP, TCPv6, UDPv6, IP, IPv6, ICMP, ICMPv6.
No active connections.
Normal condition when there are no current TCP sessions. Verify service is listening (-a) or traffic is present.
'netstat' is not recognized as an internal or external command...
PATH/environment issue or severely minimal Windows environment. Ensure %SystemRoot%\System32 is in PATH and the binary exists.
Related Commands
Continue troubleshooting with related diagnostic commands.
Official References
netstat (Windows Commands)
Microsoft Learn · Official Documentation