July 31, 2011
netstat command Detailed
Netstat for display and IP, TCP, UDP and ICMP protocols related statistics are generally used for testing the machine for each port network connectivity.
Sometimes, if your computer receives the data reported to the data that caused the error or failure, you should not be surprised, TCP / IP could allow these types of errors, and can automatically re-sent packets. However, if the total number of accounts for the error of the received IP datagram a large percentage, or the number is rapidly increasing it, then you should use the Netstat check out why there is such situation.
Netstat detailed list of parameters
(Winxp)
C: \> netstat /?
display protocol statistics and current TCP / IP network connections.
NETSTAT [-a] [-b] [-e] [-n] [-o] [-p proto] [-r] [-s] [-v] [interval] < br />
-a displays all connections and listening ports.
-b shows included in creating each connection or listening port of the executable components. In some cases, a known executable components
have multiple independent components, and in these cases included in the connection or listening port to create the component sequences are shown.
this case, the executable name at the bottom of the component [], the top is the call of the components, and so on, until the TCP / IP
part. Note that this option may take a long time, if you do not have sufficient permissions may fail.
-e Displays Ethernet statistics. This option can be used with-s
option combination.
-n in digital form address and port number.
-o display associated with each connection belongs to the process ID.
-p proto shows connections for the protocol specified by proto; proto
can be one of the following protocols: TCP, UDP, TCPv6 or UDPv6.
if used in conjunction with the-s option to display statistics by protocol, proto may be one of the following agreement:
IP, IPv6, ICMP, ICMPv6, TCP, TCPv6 , UDP, or UDPv6.
-r Displays the routing table.
-s show statistics by protocol. By default, displays IP,
IPv6, ICMP, ICMPv6, TCP, TCPv6, UDP and UDPv6 statistical information;
-p option specifies the default sub- set.
-v used in conjunction with the-b option will display included in the
for all executable components to create a connection or listening port
the component.
interval Redisplay selected statistics, each display
pause between the time interval (in seconds). Press CTRL C to stop re-
display statistics. If omitted, netstat displays the current configuration information
(only once)
(Win2000)
C: \> netstat /?

Displays protocol statistics and current TCP / IP network connections.
NETSTAT [-a] [-e] [-n] [-s] [-p proto] [-r] [interval]
-a Displays all connections and listening ports.
-e Displays Ethernet statistics. This may be combined with the-s
option.
-n Displays addresses and port numbers in numerical form.
-p proto Shows connections for the protocol specified by proto; proto
may be TCP or UDP. If used with the-s option to display
per-protocol statistics, proto may be TCP, UDP, or IP.
-r Displays the routing table.
-s Displays per-protocol statistics. By default, statistics are
shown for TCP, UDP and IP; the-p option may be used to specify < br />
a subset of the default.
interval Redisplays selected statistics, pausing interval seconds
between each display. Press CTRL C to stop redisplaying
statistics. If omitted, netstat will print the current
configuration information once.
Netstat some of the commonly used options
netstat-s – the option to display under each agreement were their statistics. If your application (such as a Web browser) run more slowly, or not display the Web page of the class of data, then you can use this option to check the information displayed. You need to look carefully at each line of statistics to find the wrong keywords, and to determine the problem.
netstat-e – This option displays statistics on the Ethernet. It lists the items, including the delivery of the total reported number of bytes of data, errors, delete the number, the number of packets and the number of broadcast. These statistics not only the number of packets sent, but also the number of received packets. This option can be used to some of the basic statistics of network traffic.
netstat-r – This option displays information about the routing table, similar to the back talking about using the route print command to see information. In addition to displaying a valid route, but also displays currently active connection.
netstat-a – This option displays a list of all valid connection information, including the establishment of the connection (ESTABLISHED), but also listens for connection requests (LISTENING) of those who connect, disconnect ( CLOSE_WAIT) or in line waiting state (TIME_WAIT), etc.
netstat-n – displays all the valid connection has been established.
Next we look at Microsoft is how to say?
this powerful Microsoft deliberately hide the command because it is somewhat complicated for the average user. We already know: Netstat can be used to get you the information system network connection (using the port, the protocol used, etc.), incoming and outgoing data, the connected remote system port, Netstat read in memory all the network information.
in Internet RFC standards, Netstat is defined as: Netstat is in the kernel to access the network and related information programs, it provides a TCP connection, TCP and UDP monitoring, process memory management related reports.
strong curiosity for people who have the above theory is tight enough, then we have to explain in detail the use of the various parameters and see what happens after the implementation of , the information displayed is what it meant, well, do not talk nonsense, and let us work together and experiment with it:)
C: \> netstat-a
Active Connections
Proto LocalAddress ForeignAddress State
TCPEagle: ftp Eagle: 0LISTENING
TCPEagle: telnet Eagle: 0LISTENING
TCPEagle : smtpEagle: 0LISTENING
TCPEagle: httpEagle: 0LISTENING
TCPEagle: epmap Eagle: 0LISTENING
TCPEagle: https Eagle: 0LISTENING
< br /> TCP Eagle: microsoft-ds Eagle: 0LISTENING
TCPEagle: 1030Eagle: 0LISTENING
TCPEagle: 6059Eagle: 0LISTENING
TCPEagle: 8001Eagle: 0LISTENING
TCPEagle: 8005Eagle: 0LISTENING
TCPEagle: 8065Eagle: 0LISTENING
TCP Eagle: microsoft-ds localhost: 1031ESTABLISHED
TCPEagle: 1031localhost: microsoft-ds ESTABLISHED
TCPEagle: 1040Eagle: 0LISTENING
TCP Eagle: netbios-ssn Eagle: 0LISTENING
TCPEagle: 1213218.85.139.65:9002 CLOSE_WAIT
TCPEagle: 2416219.133.63.142: https CLOSE_WAIT
TCPEagle: 2443219.133.63.142: https CLOSE_WAIT
TCPEagle: 2907192.168. 1.101:2774 CLOSE_WAIT
TCPEagle: 2916192.168.1.101: telnetESTABLISHED
TCPEagle: 2927219.137.227.10:4899 TIME_WAIT
TCPEagle: 2928219.137.227.10:4899 TIME_WAIT
TCPEagle: 2929219.137.227.10:4899 ESTABLISHED
TCPEagle: 3455218.85.139.65:9002 ESTABLISHED
TCP Eagle: netbios-ssn Eagle: 0LISTENING
UDP Eagle: microsoft-ds *: *
UDPEagle: 1046 *: *
UDPEagle: 1050 *: *
< br /> UDPEagle: 1073 *: *
UDPEagle: 1938 *: *
UDPEagle: 2314 *: *
UDPEagle: 2399 *: *
UDPEagle: 2413 *: *
UDPEagle: 2904 *: *
UDPEagle: 2908 *: *

UDPEagle: 3456 *: *
UDPEagle: 4000 *: *
UDPEagle: 4001 *: *
UDPEagle: 6000 *: * < br />
UDP Eagle: 6001 *: *
UDPEagle: 6002 *: *
UDPEagle: 6003 *: *
UDPEagle: 6004 *: *
UDPEagle: 6005 *: *
UDPEagle: 6006 *: *
UDPEagle: 6007 *: *
UDPEagle: 6008 *: *
UDPEagle: 6009 *: *
UDPEagle: 6010 *: *
UDPEagle: 6011 *: *
UDPEagle: 1045 *: *
UDPEagle: 1051 *: *
UDP Eagle: netbios-ns *: * < br />
UDP Eagle: netbios-dgm *: *
UDP Eagle: netbios-ns *: *
UDP Eagle: netbios-dgm *: *
we get one line to explain it:
Proto LocalAddress ForeignAddress State
TCPEagle: 2929219.137.227.10:4899 ESTABLISHED
protocol (Proto): TCP, refers to the transport layer protocol (What? know? Please use baidu search “TCP”, OSI seven-layer and TCP / IP-based four-but ^ _ ^)
local machine name (LocalAddress): Eagle, commonly known as computer name, the installation system settings, you can “My Computer” properties change, and the local open port for connection: 2929)

remote machine name (ForeignAddress): 219.137.227.10
remote port: 4899
State: ESTABLISHED
< br />