LAB: NETSTAT Command

Background

The NETSTAT (Network Statistics) command is a built-in Windows networking utility used to display information about active network connections, listening ports, routing tables, Ethernet statistics, and network protocols.

Network administrators use NETSTAT to:

• Monitor network activity

• Troubleshoot network problems

• Identify unauthorized connections

• Verify open ports

• Diagnose application communication issues

• Analyze TCP/IP performance

Prerequisites

• Windows 10 or Windows 11

• Internet connection

• Command Prompt

• Administrative privileges (recommended for some commands)

Lab Scenario

You are a junior IT support technician investigating reports of slow network performance. Your supervisor asks you to determine:

• What network connections are currently active.

• Which ports are listening for incoming connections.

• Which applications are communicating over the network.

• Whether there are any suspicious or unexpected connections.

You will use the NETSTAT command to gather and analyze network information.

Part 1 – Open Command Prompt

1. Press Windows + R

2. Type:

cmd

3. Press Enter

Part 2 – Display Active Connections

Type:

netstat

Example Output

Proto  Local Address          Foreign Address        State
TCP    192.168.1.15:49823     20.190.160.45:443      ESTABLISHED
TCP    192.168.1.15:49845     142.250.72.14:443      ESTABLISHED
TCP    192.168.1.15:49850     151.101.1.69:443       TIME_WAIT

Questions

1. How many active connections are displayed?

2. Which protocol is being used?

3. Which remote server is connected?

4. What ports are being used?

Part 3 – Display Listening Ports

Type:

netstat -an

Example Output

Proto  Local Address       Foreign Address      State
TCP    0.0.0.0:135         0.0.0.0:0            LISTENING
TCP    0.0.0.0:445         0.0.0.0:0            LISTENING
UDP    0.0.0.0:5353        *:*

Questions

1. Which ports are listening?

2. What does the LISTENING state indicate?

3. Why does UDP not show a connection state?

Part 4 – Display Executable Names

Run:

netstat -b

(Administrator privileges required.)

Example

chrome.exe
TCP 192.168.1.15:50022
142.250.72.14:443
ESTABLISHED

Questions

1. Which application is connected to the Internet?

2. Were multiple applications listed?

3. Why is administrator access required?

Part 5 – Display Process IDs (PID)

Run:

netstat -ano

Example

Proto Local Address      Foreign Address      State        PID
TCP   192.168.1.15:51001 13.107.42.16:443     ESTABLISHED  12540

Now open Task Manager.

1. Press Ctrl + Shift + Esc

2. Select the Details tab.

3. Match the PID from NETSTAT to the running process.

Complete the Table

Part 6 – Display Ethernet Statistics

Run:

netstat -e

Example Output

Interface Statistics

Received Bytes    23546782
Sent Bytes        19876455

Questions

1. How many bytes have been received?

2. How many bytes have been sent?

3. Which value is larger?

Part 7 – Display Network Statistics

Run:

netstat -s

Observe statistics for:

• TCP

• UDP

• IPv4

• IPv6

Questions

1. Which protocol transmitted the most packets?

2. Were any errors reported?

3. Why are these statistics useful?

Part 8 – Display the Routing Table

Run:

netstat -r

Questions

1. What is the default gateway?

2. What is the network destination?

3. Why is the routing table important?

Part 9 – Refresh Connections Continuously

Run:

netstat -an 5

The display refreshes every 5 seconds.

Observe:

• New connections

• Closed connections

• Listening ports

Press Ctrl + C to stop.

Questions

1. Did connections change over time?

2. Why would continuous monitoring be useful?

Part 10 – Understanding TCP Connection States

Review the NETSTAT output and identify examples of the following states (if present):

Questions

1. Which connection state appeared most often?

2. Why is TIME_WAIT normal?

3. What does ESTABLISHED indicate?

Part 11 – Troubleshooting Exercise

1. Open a web browser and visit several websites.

2. Run:

netstat -ano

3. Observe:

• New remote IP addresses

• New ports

• New PIDs

4. Close the browser.

5. Run the command again.

Questions

1. Did the connections disappear?

2. Why did some remain in TIME_WAIT?

3. Which application created the most connections?

Lab Questions

1. What is the purpose of the NETSTAT command?

2. What does LISTENING mean?

3. What is a PID?

4. Which command displays executable names?

5. Which command displays routing information?

6. Why are ports important?

7. What is the difference between TCP and UDP?

8. Why would a cybersecurity analyst use NETSTAT?

9. What command continuously refreshes NETSTAT?

10. How can NETSTAT help identify malware or unauthorized network activity?

Challenge Activity

Investigate your computer’s network activity while running different applications.

1. Open a web browser.

2. Open Microsoft Teams or another collaboration application.

3. Open a music or video streaming service.

4. Run:

netstat -ano

Record your findings.

Deliverables

Students must submit:

• Screenshots of each NETSTAT command executed.

• Completed tables and analysis.

• Answers to all lab questions.

• A one-page summary explaining how NETSTAT helps monitor and troubleshoot network activity.

• A reflection describing what they learned about active connections, ports, and processes.

Learning Outcomes

Upon successful completion of this lab, students will be able to:

• Explain the purpose and functionality of the NETSTAT command.

• Display and interpret active network connections.

• Identify listening ports and associated applications.

• Match Process IDs (PIDs) to running programs.

• Analyze Ethernet and protocol statistics.

• Interpret TCP connection states.

• Monitor network activity over time.

• Apply NETSTAT as a troubleshooting and security tool to identify connectivity issues, verify services, and detect unusual network behavior.

Bonus Activity (Advanced)

Research the following well-known TCP/UDP ports and identify whether they appear in your NETSTAT output.

Reflection: Explain how understanding ports, connection states, and running processes can help an IT technician troubleshoot network issues and recognize potentially malicious network activity.