NETSTAT.EXE

netstat.exe can be used in command line programs such as cmd.exe or PowerShell to display

active TCP/IP connections
ports on which the computer is listening
ethernet statistics
the IP routing table
IPv4 statistics (IP, ICMP, TCP and UDP protocols)
IPv6 statistics (IPv6, ICMPv6, TCP over IPv6 and UDP over IPv6 protocols)

Displaying active TCP connections

Active TCP connections are displayed without passing parameters to netstat.exe.

c:\> netstat

Active Connections

  Proto  Local Address          Foreign Address        State
  TCP    127.0.0.1:5127         LAPTOP-007:57476       ESTABLISHED
  TCP    127.0.0.1:37897        LAPTOP-007:57857       TIME_WAIT
  TCP    127.0.0.1:37897        LAPTOP-007:57878       TIME_WAIT
  …

Since this command only shows active connections, the state cannot be LISTENING and usually is one of ESTABLISHED or TIME_WAIT.

Don't resolve names of IP numbers

By default, an attempt is made to resolve the name of IP numbers (such as LAPTOP-007 in the example above).

This can be quite slow and at times undesired. It can be turned off with -n or /n which prints IP numbers only (and can be much faster).

c:\> netstat -n

Active Connections

  Proto  Local Address          Foreign Address        State
  TCP    127.0.0.1:5127         127.0.0.1:57476        ESTABLISHED
  TCP    127.0.0.1:37897        127.0.0.1:57857        TIME_WAIT
  TCP    127.0.0.1:37897        127.0.0.1:57878        TIME_WAIT

Adding listeners to the output

Using /a or -a adds the TCP or UDP ports on which a process is listening, too. That is, the LISTENING is added to the reported State.

c:\> netstat -na

Active Connections

  Proto  Local Address          Foreign Address        State
  TCP    0.0.0.0:22             0.0.0.0:0              LISTENING
  TCP    0.0.0.0:135            0.0.0.0:0              LISTENING
  TCP    0.0.0.0:445            0.0.0.0:0              LISTENING
  …
  TCP    127.0.0.1:5127         127.0.0.1:57476        ESTABLISHED
  TCP    127.0.0.1:37897        127.0.0.1:57857        TIME_WAIT

Adding bound non-listening ports

Using -q adds bound non-listening ports (and listining ports, as -a) in the output. Thus, State can also be BOUND.

c:\> netstat -nq
  TCP    0.0.0.0:22             0.0.0.0:0              LISTENING
  TCP    0.0.0.0:135            0.0.0.0:0              LISTENING
  …
  TCP    0.0.0.0:49676          0.0.0.0:0              BOUND
  TCP    0.0.0.0:49738          0.0.0.0:0              BOUND

Displaying the involved process's ID

-o or /o adds a connection's owning process' process id (PID) in a separate column.

c:\> netstat -nao

Active Connections

  Proto  Local Address          Foreign Address        State           PID
  TCP    0.0.0.0:22             0.0.0.0:0              LISTENING       5908
  TCP    0.0.0.0:135            0.0.0.0:0              LISTENING       1244
  TCP    0.0.0.0:445            0.0.0.0:0              LISTENING       4
  …
  TCP    127.0.0.1:49679        127.0.0.1:54784        ESTABLISHED     5380
  …

With the Process ID (PID) and taskkill.exe, it is possible to kill a process (that might be blocking a special port).

Listing the involved executable name

-b prints the executable name (rather than the ID) of the process that made a connection or is listening for a connection.

Using this parameter requires elevated privileges.

Because the executable name is printed on a separate line after the connection details, it is recommended to search for a given connection with select-string and the -context option:

PS C:> netstat -anb | select-string 9999 -context 0,1

>   TCP    0.0.0.0:9999           0.0.0.0:0              LISTENING
   [VirtualBoxVM.exe]

Limiting output to specific protocols only

Using -p or /p limits the output to specific protocols:

c:\> netstat -p tcp
c:\> netstat -p tcpv6
c:\> netstat -p udp
c:\> netstat -p udpv6
c:\> netstat -p ip
c:\> netstat -p ipv6
c:\> netstat -p icmp