Show
On Windows 10, netstat (network statistics) has been around for a long time, and it's a command-line tool that you can use in Command Prompt to display statistics for all network connections. It allows you to understand open and connected ports to monitor and troubleshoot networking problems for system or applications. When using this tool, you can list active networks (incoming and outgoing) connections and listening ports. You can view network adapter statistics as well as statistics for protocols (such as IPv4 and IPv6). You can even display the current routing table, and much more. In this Windows 10 guide, we'll walk you through the steps to use the netstat command to examine connections to discover open and connected network ports.
How to use netstat on Windows 10To get started with netstat, use these steps:
Once you execute the command, it'll return a list of all active connections in four columns, including:
How to use netstat parameters on Windows 10The tool also includes several parameters that you can use in Command Prompt to display different information about the network connections. Show active and inactive connectionsThe
command displays all active and inactive connections, and the TCP and UDP ports the device is currently listening. Source: Windows Central (Image credit: Source: Windows Central)Show executable informationThe
command lists all the executables (applications) associated with each connection. Sometimes, applications may open multiple connections. Source: Windows Central (Image credit: Source: Windows Central)Show network adapter statisticsThe
command generates a statistic of the network interface, which shows information like the number of bytes, unicast and non-unicast sent and received packets. You can also see discarded packets and errors and unknown protocols, which can you troubleshoot networking problems. Source: Windows Central (Image credit: Source: Windows Central)Show FQDNS for foreign addressesThe
command shows the fully qualified domain name (FQDN) for foreign addresses. For example, "server-54-230-157-50.otp50.r.cloudfront.net:http" instead of "server-54-230-157-50:http" or "54.230.157.50". Source: Windows Central (Image credit: Source: Windows Central)Show numerical formThe
command displays the addresses and ports in numerical form. For example, 54.230.157.50:443. Source: Windows Central (Image credit: Source: Windows Central)Show process IDThe
command shows all active TCP connections like
, but with the difference that adds a fifth column to display the Process ID (PID) for each connection. The processes available in this view are the same in the "Details" tab of Task Manager, which also reveals the application using the connection. Source: Windows Central (Image credit: Source: Windows Central)Show connections by ProtocolThe
can be used to display connections per-protocol that you have to specify using
,
,
, or
next to the command. For example, you can use the
to view a list of TCP connections. Source: Windows Central (Image credit: Source: Windows Central)Show listening and non-listening portsThe
commands can produce a list of all the connections with the listening and bound non-listening ports. Source: Windows Central (Image credit: Source: Windows Central)Show statistics by ProtocolThe
shows network statistics for all available protocols, including TCP, UDP, ICMP, and IP protocols (version 4 and 6). Source: Windows Central (Image credit: Source: Windows Central)Show routing tableThe
command displays the current network routing table that lists all the routes to destinations and matrics known by the device, for IP version 4 and version 6 (if applicable). If the returned information looks familiar, it's because you can also output the data using the
command. Source: Windows Central (Image credit: Source: Windows Central)Show offload state connectionsThe
command generates a list of the current connection offload state. The offload state refers to the TCP Chimney Offload (opens in new tab), which is a feature that transfers the network workload from the processor to the network adapter during data transmissions. The "InHost" value indicates that offloading isn't enabled, and the "Offload" means that the feature is transferring the workload to the network adapter. (This feature is only present on supported network adapters.) Show NetworkDirect connectionsThe
is another supported command on Windows 10, and it produces a list of NetworkDirect connections, shared endpoints, and listeners. NetworkDirect (opens in new tab) is a specification for Remote Direct Memory Access (RDMA), which is a process that allows fast data transfers using the network adapter, freeing up the processor to perform other tasks. Usually, you'll never use this command unless you're using the server version of Windows or a high-performance application with a network adapter that supports this feature. Show connection templateThe
command displays TCP connections templates for all connections. Source: Windows Central (Image credit: Source: Windows Central)Combine parametersWhen using the
command, you can also combine the parameters to display various information together for many cases. For example, the
parameter can also be used with the
parameter to see statistics for each available protocol, and the
parameter can be combined with
,
, and
as necessary. Source: Windows Central (Image credit: Source: Windows Central)With the
command, you append the
parameter, you can display statistics from even more protocols, including
,
,
, and
. Also, when using more than one parameter, you can combine them with a single
. For example, instead of writing the command
, you can write it like this:
. Source: Windows Central (Image credit: Source: Windows Central)If you want to see all the available parameters and additional help, you can always use the
command. How to search netstat details on Windows 10In addition to displaying all the available statistic information, you can also output only the certain details you need using these steps:
The findstr command isn't part of the netstat tool. It's a simple command to search for a text string in a file, but you can use it with many of the netstat commands to make more sense of the information you're viewing. The netstat command is available on Windows 10, but you can also find it on Windows Server, Windows 8.x, Windows 7, and older versions. The tool is not exclusive to Windows either, as it's also available across platforms, including Linux and macOS. Even though the parameters and syntax may be different, they all are very similar. Mauro Huculak is technical writer for WindowsCentral.com. His primary focus is to write comprehensive how-tos to help users get the most out of Windows 10 and its many related technologies. He has an IT background with professional certifications from Microsoft, Cisco, and CompTIA, and he's a recognized member of the Microsoft MVP community. What parameters for netstat should you use to show all the established TCP connections?To investigate the status of all the current TCP/IP connections and identify which IP services are running on a particular system, use the NETSTAT utility's base parameters, –a and –n. You can even combine the two parameters for a concise analysis of the of the current TCP/IP connections.
What is netstat used for?The network statistics ( netstat ) command is a networking tool used for troubleshooting and configuration, that can also serve as a monitoring tool for connections over the network. Both incoming and outgoing connections, routing tables, port listening, and usage statistics are common uses for this command.
What is netstat TCP?The Work with TCP/IP Network Status (WRKTCPSTS) command, also known as NETSTAT, is used to get information about the status of TCP/IP network routes, interfaces, TCP connections and UDP ports on your local system. You can also use NETSTAT to end TCP/IP connections and to start or end TCP/IP interfaces.
What parameter is used with netstat command to display the programs that are involved in creating the current TCP IP connections?netstat -o : Displays active TCP connections and includes the process id (PID) for each connection. You can find the application based on the PID in the Processes tab in Windows Task Manager. This parameter can be combined with -a, -n, and -p.
|