Windows command line networking: netstat

00:08:48
https://www.youtube.com/watch?v=OZjq1kjes-U

Ringkasan

TLDRThe video is a practical demonstration of using the netstat command in Windows. The presenter explains how to open the command prompt as an administrator, especially on Vista and later versions. Netstat is shown as a powerful tool for monitoring active network connections, displaying details such as IP addresses, port numbers, and connection status. Different switches are discussed, like netstat -a for listing all connections, netstat -e for showing sent and received byte statistics, and netstat -r for displaying the routing table. TCP and UDP differences are explained, emphasizing TCP's reliability for downloads versus UDP's efficiency for streaming. Various insights into network traffic and system behavior can be observed using these commands, and the presenter highlights the potential of netstat in identifying unexpected network activity, indicating possible malware presence.

Takeaways

  • 💻 Netstat is useful for checking network connections on Windows.
  • 🔒 Run the command prompt as an administrator for full access to netstat features.
  • 📡 Netstat -a shows all current connections along with TCP/UDP status.
  • 📊 Use netstat -e to observe bytes received and sent.
  • 🌍 Netstat -r displays the routing table of your computer.
  • ⚠️ TCP is reliable, requiring acknowledgments, unlike UDP.
  • 🎥 Streaming often uses UDP due to its efficiency despite lack of confirmation.
  • 🛡️ Netstat can help detect unusual network activity hinting at malware.
  • 🔄 Netstat -1 allows for real-time monitoring with updates every second.
  • 🔎 Netstat -b can identify the program using a network connection.

Garis waktu

  • 00:00:00 - 00:08:48

    The speaker introduces a video about using the 'netstat' command while downloading a file, explaining its basic function of showing internet connections and IP addresses. They demonstrate how to open the command prompt on different Windows versions. The command provides details about current internet connections, download activity, and the status of these connections, emphasizing how netstat can help diagnose internet connectivity issues.

Peta Pikiran

Mind Map

Pertanyaan yang Sering Diajukan

  • What does the netstat command do?

    The netstat command provides various options to display active connections and network statistics, showing details like IP addresses, port numbers, and protocols.

  • How can you run the command prompt as an administrator on Vista and later?

    Right-click on the command prompt icon and choose 'Run as administrator'.

  • What differences does netstat show between TCP and UDP?

    TCP connections provide confirmation for received packets, whereas UDP does not confirm receipt.

  • How does netstat help in monitoring downloads?

    It shows details like IP address, port number, and whether the connection is established or waiting.

  • What is shown with the netstat -a command?

    It shows all current connections along with their listening status and whether they use TCP or UDP.

  • What information can you get from netstat -e?

    Netstat -e shows statistics about the bytes received and sent, displaying network traffic.

  • What does netstat -r display?

    The netstat -r command displays the routing table, which includes IP addresses, subnet masks, and network card information.

  • What is the use of netstat -b?

    Netstat -b shows the process using a connection, helpful for identifying applications like Internet Explorer.

  • How often can netstat show statistics with the -1 option?

    Netstat can display updated statistics every second with the -1 option.

  • What can you infer if netstat indicates multiple connections to unknown servers?

    It might suggest infection by malware such as viruses, worms, or spyware.

Lihat lebih banyak ringkasan video

Dapatkan akses instan ke ringkasan video YouTube gratis yang didukung oleh AI!
Teks
en
Gulir Otomatis:
  • 00:00:00
    hello there today uh I'm making a video
  • 00:00:03
    on netstat and I'm uh doing a download
  • 00:00:07
    at the same time so let me uh click
  • 00:00:09
    Start and uh pull up a command prompt
  • 00:00:12
    you uh if you're an XP you can click
  • 00:00:14
    Start run type in CMD but on Vista and
  • 00:00:17
    later I need to right click and run as
  • 00:00:20
    administrator or else some of these
  • 00:00:21
    commands are probably not going to work
  • 00:00:23
    unless I Elevate the command
  • 00:00:27
    prompt so uh
  • 00:00:32
    netstat you can read the uh switches
  • 00:00:35
    with a netstat mark but uh I'm going to
  • 00:00:39
    go over them all anyway so netstat is a
  • 00:00:42
    command that can be run by
  • 00:00:44
    itself and it shows uh connections that
  • 00:00:47
    I have to the internet right
  • 00:00:49
    now shows that I'm actually uh
  • 00:00:52
    downloading a file right now I uh but
  • 00:00:56
    apparently I'm getting it from Min
  • 00:00:57
    machines so it'll show my IP address the
  • 00:01:01
    port number that's it's listening on and
  • 00:01:03
    the uh foreign address that I'm
  • 00:01:05
    receiving the uh the command from and it
  • 00:01:08
    says it's established on this one but
  • 00:01:10
    these are waiting so that means the
  • 00:01:12
    downloads taking a little longer than
  • 00:01:14
    expected uh so I'm going to do a control
  • 00:01:17
    C to uh get out of
  • 00:01:28
    here there we go finally all right so
  • 00:01:33
    download looks like it's stalled that's
  • 00:01:35
    fine uh so net
  • 00:01:41
    stat it also has the- a will show
  • 00:01:46
    all
  • 00:01:47
    typo netstat-a shows all of the uh
  • 00:01:51
    connections that my computer's currently
  • 00:01:52
    making from the IP address that it's
  • 00:01:55
    using to make that connection to the
  • 00:01:58
    connection it's making for
  • 00:02:00
    wise and uh whether it's listening or
  • 00:02:03
    not listening also shows TCP or UDP
  • 00:02:09
    connections uh TCP means that when my
  • 00:02:12
    computer receives a download it sends a
  • 00:02:14
    confirmation that it received that
  • 00:02:16
    download UDP means that whoever sent it
  • 00:02:19
    just sent it and whether I got it or not
  • 00:02:21
    is uh if I didn't get it tough luck I
  • 00:02:23
    should ask for it again manually ask for
  • 00:02:25
    it
  • 00:02:26
    again
  • 00:02:28
    um so when you get downloads they're
  • 00:02:30
    generally TCP because you want to make
  • 00:02:33
    sure you get all the download so your
  • 00:02:34
    computer if it doesn't get all the
  • 00:02:36
    download it'll manually ask for it again
  • 00:02:38
    if it's something like audio or video
  • 00:02:41
    that you're watching on the Internet
  • 00:02:42
    it's generally UDP because if you don't
  • 00:02:46
    get all the audio or video then you're
  • 00:02:48
    just going to replay the video again
  • 00:02:50
    because you really wanted to watch that
  • 00:02:51
    video without
  • 00:02:54
    interruptions um so netstat-a
  • 00:02:58
    net stat
  • 00:03:01
    dase will show my statistics it will
  • 00:03:03
    show bytes received bytes sent and uh
  • 00:03:07
    various information like that just shows
  • 00:03:09
    that I have internet
  • 00:03:10
    connectivity um that's the main thing it
  • 00:03:13
    just shows that I'm able to send and
  • 00:03:14
    receive
  • 00:03:15
    traffic uh netstat DP we sort it by
  • 00:03:19
    protocol so I can do by
  • 00:03:22
    TCP shows that I am talking to somebody
  • 00:03:25
    through TCP I can do UDP
  • 00:03:31
    nothing
  • 00:03:33
    icmp no good uh
  • 00:03:40
    TCP version
  • 00:03:42
    six nothing
  • 00:03:45
    there
  • 00:03:47
    UDP version six nothing there but that's
  • 00:03:51
    understandable because I'm just my only
  • 00:03:52
    connection to internet right now is uh
  • 00:03:55
    the download and it is
  • 00:03:57
    TCP but uh those are the five protocols
  • 00:03:59
    they let you
  • 00:04:00
    use uh netstat DS will show a similar
  • 00:04:05
    to- e but in more detail so it's a much
  • 00:04:09
    longer
  • 00:04:13
    output and uh net st-r will show my
  • 00:04:17
    routing table let me clear the screen
  • 00:04:19
    before I pull that one up because that
  • 00:04:20
    one's a long
  • 00:04:22
    one net st-r will show my routing table
  • 00:04:26
    which is how my computer figures out how
  • 00:04:27
    to handle packets if if it receives a
  • 00:04:30
    packet address for this IP address with
  • 00:04:32
    this subnet mask on either one of these
  • 00:04:35
    network cards it will listen to it and
  • 00:04:38
    it keeps doing this again and again
  • 00:04:40
    these IP addresses these subnet masks
  • 00:04:44
    these network cards it listens to it
  • 00:04:47
    till eventually it gets to the point
  • 00:04:48
    where it gets to anything with any for a
  • 00:04:52
    subnet mask on this network card should
  • 00:04:55
    be addressed to the default gateway
  • 00:04:59
    and uh these up here are just the
  • 00:05:01
    columns that label each column similar
  • 00:05:04
    to a route print and that was
  • 00:05:06
    a net st-r shows my routing
  • 00:05:11
    table oops netstat d r shows my routing
  • 00:05:15
    table uh there's
  • 00:05:17
    also net stat with one which will
  • 00:05:21
    display net stat net stat in one second
  • 00:05:24
    intervals so it shows just the one
  • 00:05:26
    download but let me uh pull
  • 00:05:30
    up video. goole.com actually let me pull
  • 00:05:34
    up
  • 00:05:42
    google.com and then uh let's go
  • 00:05:45
    to
  • 00:05:50
    video and maybe
  • 00:05:54
    Maps so let me close that and you can
  • 00:05:57
    see that it just went crazy as soon as I
  • 00:05:59
    I closed that window it went back to
  • 00:06:02
    normal so
  • 00:06:07
    uh right here is uh where I opened
  • 00:06:09
    Google and everything was cool it was
  • 00:06:11
    showing nice simple statistics and then
  • 00:06:14
    I went to Maps actually this was the
  • 00:06:16
    search
  • 00:06:17
    results and then more search results and
  • 00:06:20
    then the maps and that shows all the
  • 00:06:22
    connections that I made on that one
  • 00:06:24
    page and then as soon as I closed it it
  • 00:06:27
    went back to normal and I pressed
  • 00:06:29
    control C to cancel that so that was a
  • 00:06:33
    net Stat one so that's a refresh
  • 00:06:35
    interval of every 1 second it'll show
  • 00:06:39
    netstat there's uh some other things
  • 00:06:42
    that I don't use a lot there's netstat
  • 00:06:45
    DB and all these are going to look
  • 00:06:47
    similar it'll show a
  • 00:06:49
    protocol it'll show the local address
  • 00:06:53
    that's using the uh connection the
  • 00:06:56
    foreign address that I'm making the
  • 00:06:57
    connection with and and then it's
  • 00:06:59
    established the difference is netstat DB
  • 00:07:02
    will show the program that is using to
  • 00:07:06
    uh make the connection which is Internet
  • 00:07:10
    Explorer so uh netstat
  • 00:07:13
    Dash
  • 00:07:16
    F shows the fully qualified domain
  • 00:07:19
    version so all of this is the same
  • 00:07:21
    except that it shows the net that I'm
  • 00:07:24
    connected
  • 00:07:26
    to uh netstat DN we'll do similar except
  • 00:07:30
    it shows a numerical form IP address and
  • 00:07:34
    port number instead of before which
  • 00:07:35
    showed HTTP this time it shows Port 80
  • 00:07:38
    which is
  • 00:07:41
    HTTP uh next
  • 00:07:45
    at-
  • 00:07:47
    o will show the process ID an extra
  • 00:07:51
    column over here with the process ID so
  • 00:07:53
    if I need to kill it then uh in
  • 00:07:56
    Powershell or task manager I know it's
  • 00:07:58
    process ID so I can kill it and net
  • 00:08:03
    st-t will uh look similar but it shows
  • 00:08:07
    offload state so what to do with it
  • 00:08:09
    means keep
  • 00:08:11
    it in host so uh remember this command
  • 00:08:15
    is
  • 00:08:16
    netstat uh I use it a lot just to see if
  • 00:08:19
    anything's going on with my computer if
  • 00:08:21
    my computer seems to be running slow
  • 00:08:23
    I'll use it a lot to see if
  • 00:08:26
    uh if it's making connection Maybe have
  • 00:08:29
    some kind of worm or bot or spyware or
  • 00:08:33
    something on my computer going crazy but
  • 00:08:35
    this shows me what current current what
  • 00:08:38
    current connections that I have coming
  • 00:08:40
    in and out of my computer so hopefully
  • 00:08:42
    you've learned some from this and you'll
  • 00:08:43
    get to play with networking more for it
  • 00:08:45
    so thank you for watching
Tags
  • netstat
  • network monitoring
  • Windows command
  • TCP
  • UDP
  • routing table
  • network connections
  • malware detection