Windows 10 netstart commands (Image credit: Windows Central)
On Windows 10, netstat (network statistics) has been around for a long time, and it's a command-line tool that you can use in Command Prompt to display statistics for all network connections. It allows you to understand open and connected ports to monitor and troubleshoot networking problems for system or applications.
When using this tool, you can list active networks (incoming and outgoing) connections and listening ports. You can view network adapter statistics as well as statistics for protocols (such as IPv4 and IPv6). You can even display the current routing table, and much more.
In this Windows 10 guide, we'll walk you through the steps to use the netstat command to examine connections to discover open and connected network ports.
- How to use netstat on Windows 10
- How to use netstat parameters on Windows 10
- How to search netstat details on Windows 10
How to use netstat on Windows 10
To get started with netstat, use these steps:
- Open Start.
- Search for Command Prompt, right-click the top result, and select the Run as administrator option.
- Type the following command to show all active TCP connections and press Enter:netstat
Source: Windows Central (Image credit: Source: Windows Central)
- (Optional) Type the following command to display active connections showing numeric IP address and port number instead of trying to determine the names and press Enter:netstat -n
Source: Windows Central (Image credit: Source: Windows Central)
- (Optional) Type the following command to refresh the information at a specific interval and press Enter:netstat -n INTERVALIn the command, make sure to replace INTERVAL for the number (in seconds) you want to redisplay the information.This example refreshes the command in question every five seconds:netstat -n 5Quick note: When using the interval parameter, you can terminate the command using the Ctrl + C keyboard shortcut in the console.
Source: Windows Central (Image credit: Source: Windows Central)
Once you execute the command, it'll return a list of all active connections in four columns, including:
- Proto: Shows the connection protocol (TCP or UDP).
- Local Address: Shows the computer's IP address followed by a semicolon with a port number of the connection. The double-semicolon inside brackets indicates the local IPv6 address, and "0.0.0.0" refers to the local address too.
- Foreign Address: Lists the remote device's IP (or FQDN) address with the port number after semicolon port name (for example, https, http, microsoft-ds, wsd).
- State: Indicates where the connection is active (established), the local port has been closed (time_wait), and the program hasn't closed the port (close_wait). Other status include, closed, fin_wait_1, fin_wait_2, last_ack, listen, syn_received, syn_send, and timed_wait.
How to use netstat parameters on Windows 10
The tool also includes several parameters that you can use in Command Prompt to display different information about the network connections.
Show active and inactive connections
The
netstat -acommand displays all active and inactive connections, and the TCP and UDP ports the device is currently listening.
Source: Windows Central (Image credit: Source: Windows Central)
Show executable information
The
netstat -bcommand lists all the executables (applications) associated with each connection. Sometimes, applications may open multiple connections.
Source: Windows Central (Image credit: Source: Windows Central)
Show network adapter statistics
The
netstat -ecommand generates a statistic of the network interface, which shows information like the number of bytes, unicast and non-unicast sent and received packets. You can also see discarded packets and errors and unknown protocols, which can you troubleshoot networking problems.
Show FQDNS for foreign addresses
The
netstat -fcommand shows the fully qualified domain name (FQDN) for foreign addresses. For example, "server-54-230-157-50.otp50.r.cloudfront.net:http" instead of "server-54-230-157-50:http" or "54.230.157.50".
Source: Windows Central (Image credit: Source: Windows Central)
Show numerical form
The
netstat -ncommand displays the addresses and ports in numerical form. For example, 54.230.157.50:443.
Source: Windows Central (Image credit: Source: Windows Central)
Show process ID
The
netstat -ocommand shows all active TCP connections like
netstat, but with the difference that adds a fifth column to display the Process ID (PID) for each connection. The processes available in this view are the same in the "Details" tab of Task Manager, which also reveals the application using the connection.
Source: Windows Central (Image credit: Source: Windows Central)
Show connections by Protocol
The
netstat -pcan be used to display connections per-protocol that you have to specify using
tcp,
udp,
tcpv6, or
udpv6next to the command. For example, you can use the
netstat -p tcpto view a list of TCP connections.
Source: Windows Central (Image credit: Source: Windows Central)
Show listening and non-listening ports
The
netstat -qcommands can produce a list of all the connections with the listening and bound non-listening ports.
Show statistics by Protocol
The
netstat -sshows network statistics for all available protocols, including TCP, UDP, ICMP, and IP protocols (version 4 and 6).
Source: Windows Central (Image credit: Source: Windows Central)
Show routing table
The
netstat -rcommand displays the current network routing table that lists all the routes to destinations and matrics known by the device, for IP version 4 and version 6 (if applicable). If the returned information looks familiar, it's because you can also output the data using the
route printcommand.
Source: Windows Central (Image credit: Source: Windows Central)
Show offload state connections
The
netstat -tcommand generates a list of the current connection offload state. The offload state refers to the TCP Chimney Offload (opens in new tab), which is a feature that transfers the network workload from the processor to the network adapter during data transmissions. The "InHost" value indicates that offloading isn't enabled, and the "Offload" means that the feature is transferring the workload to the network adapter. (This feature is only present on supported network adapters.)
Show NetworkDirect connections
The
netstat -xis another supported command on Windows 10, and it produces a list of NetworkDirect connections, shared endpoints, and listeners.
NetworkDirect (opens in new tab) is a specification for Remote Direct Memory Access (RDMA), which is a process that allows fast data transfers using the network adapter, freeing up the processor to perform other tasks. Usually, you'll never use this command unless you're using the server version of Windows or a high-performance application with a network adapter that supports this feature.
Show connection template
The
netstat -ycommand displays TCP connections templates for all connections.
Source: Windows Central (Image credit: Source: Windows Central)
Combine parameters
When using the
netstatcommand, you can also combine the parameters to display various information together for many cases.
For example, the
-eparameter can also be used with the
-sparameter to see statistics for each available protocol, and the
-oparameter can be combined with
-a,
-n, and
as necessary.
Source: Windows Central (Image credit: Source: Windows Central)
With the
netstat -pcommand, you append the
sparameter, you can display statistics from even more protocols, including
icmp,
ip,
icmpv6, and
ipv6.
Also, when using more than one parameter, you can combine them with a single
-. For example, instead of writing the command
netstat -e -s, you can write it like this:
netstat -es.
Source: Windows Central (Image credit: Source: Windows Central)
If you want to see all the available parameters and additional help, you can always use the
netstat /?command.
How to search netstat details on Windows 10
In addition to displaying all the available statistic information, you can also output only the certain details you need using these steps:
- Open Start.
- Search for Command Prompt, right-click the top result, and select the Run as administrator option.
- Type the following command to list all the connections that have the state set to LISTENING and press Enter:netstat -q | findstr STRINGIn the command, make sure to replace STRING for the information you want to list. Also, the findstr option is case sensitive, which means that you must enter the string you want to find with the exact casing.This example lists all the connections that have the state set to "LISTENING."netstat -q | findstr LISTENINGThis other example shows all the connections from a foreign server FQDN, in this case, Amazon:netstat -f | findstr amazonAs you can see, you only need to type part of the string to return a result.
Source: Windows Central (Image credit: Source: Windows Central)
The findstr command isn't part of the netstat tool. It's a simple command to search for a text string in a file, but you can use it with many of the netstat commands to make more sense of the information you're viewing.
The netstat command is available on Windows 10, but you can also find it on Windows Server, Windows 8.x, Windows 7, and older versions. The tool is not exclusive to Windows either, as it's also available across platforms, including Linux and macOS. Even though the parameters and syntax may be different, they all are very similar.
Mauro Huculak is technical writer for WindowsCentral.com. His primary focus is to write comprehensive how-tos to help users get the most out of Windows 10 and its many related technologies. He has an IT background with professional certifications from Microsoft, Cisco, and CompTIA, and he's a recognized member of the Microsoft MVP community.