kentoh - Fotolia
How to use a netstat command in Windows to watch open ports
Mike Cobb shows how a simple command line tool can provide invaluable information about what's happening on your system
Netstat, the TCP/IP networking utility, has a simple set of options and identifies a computer’s listening ports, along with incoming and outgoing network connections. This data can be very helpful if you’re trying to resolve a malware issue or diagnose a security problem.
I have to admit, I much prefer graphical user interfaces when it comes to working on a computer. I’ve never been a big fan of command line tools, but occasionally some, such as Netstat, do come into their own.
Another reason I find Netstat such a useful tool is that it can be found on almost any computer by default, from Unix and Linux machines through to Windows and Macs. The fact you don’t have to install and run a separate diagnostic tool can be a life saver when dealing with a client’s PC or a quarantined machine.
Every open port on your computer is an entry point that can be exploited to gain covert access. So if you need to know what connections a machine has to the internet and what services may be open and running, Netstat can quickly tell you.
Let me explain how to Netstat command in Windows. First, just open a command prompt window and type:
netstat -an
The -a parameter lists all the computer’s connections and listening ports, while the -n parameter displays addresses and port numbers in numerical format. A typical (truncated) result from Netstat -an looks like this:
Active Connections
| Proto Local Address | Foreign Address | State |
| TCP 0.0.0.0:21 | 0.0.0.0:0 | LISTENING |
| TCP 0.0.0.0:25 | 0.0.0.0:0 | LISTENING |
| TCP 0.0.0.0:80 | 0.0.0.0:0 | LISTENING |
| TCP 0.0.0.0:135 | 0.0.0.0:0 | LISTENING |
| TCP 0.0.0.0:443 | 0.0.0.0:0 | LISTENING |
| TCP 0.0.0.0:445 | 0.0.0.0:0 | LISTENING |
| TCP 0.0.0.0:1035 | 0.0.0.0:0 | LISTENING |
| TCP 0.0.0.0:3351 | 0.0.0.0:0 | LISTENING |
| TCP 127.0.0.1:1040 | 0.0.0.0:0 | LISTENING |
| TCP 127.0.0.1:1049 | 0.0.0.0:0 | LISTENING |
| TCP 127.0.0.1:1059 | 127.0.0.1:27015 | ESTABLISHED |
| TCP 127.0.0.1:1085 | 0.0.0.0:0 | LISTENING |
| TCP 127.0.0.1:1434 | 0.0.0.0:0 | LISTENING |
| TCP 127.0.0.1:5152 | 0.0.0.0:0 | LISTENING |
| TCP 127.0.0.1:5152 | 127.0.0.1:3414 | CLOSE_WAIT |
The first column (proto stands for protocol) lists all of the transmission control protocol (TCP) and user datagram protocol (UDP) connections on the machine running Netstat. The second column is the machine’s local IP address and port number, while the third is the remote or foreign address and port number. The final column is called State, which is the state that the connection, or potential connection, is in.
Built-in Windows commands that can find hack attempts
“LISTENING” shows a classic open port listening for inbound connections. “ESTABLISHED” means there’s an actual connection between your machine and the remote IP and port that is able to exchange traffic. Occasionally, you’ll see “CLOSE_WAIT” in this column, which is a state TCP goes into while ending an established connection.
As you can see, there are plenty of entries with a local address of 0.0.0.0 plus a port. This designation means the port is listening on all network interfaces and will accept any incoming connection on that port number.
The local address entries beginning 127.0.0.1 are processes listening for connections from the PC itself, not from the Internet or network. If the IP address in this column is your local network IP, then the port is only listening for connections from your local network. The port is listening for connections from the Internet if it displays your online IP address.
A quick glance through Netstat’s output can alert you to many potential problems. For example, if your security policy bans the use of internet relay chat (IRC), but there are numerous connections to port 6667 (the default IRC port) on a remote machine, then there's a chance that the PC has a Trojan connected to a remote IRC server waiting to receive commands. Although Netstat only takes a snapshot, you can use the interval option to refresh the output every so many seconds. Use the Netstat command below, for example:
netstat –an 1 | find “3333”
The command will check every second and print the results if a process starts listening on TCP port 3333.
If you want to find out which process on a machine is sending out packets to a particular machine you can run:
netstat –ano 1 | find “Dest_IP_Addr”
The -o parameter outputs the process ID (PID) responsible for the connection. You can then find the program associated with a PID by typing “tasklist” at the Netstat command prompt. You can also use netstat’s -b flag, which outputs the EXE and its associated DLLs that are using the TCP and UDP ports. Finally, if you want to know when another system, such as a bot controller, connects to a machine listening on a particular TCP port, such as port 4444, you can run:
netstat –an 1 | find “4444” | find “ESTABLISHED”
In this example, Netstat will not display an output until it finds an established connection on port 4444, and it will include the source IP address connected to the port, a helpful bit of information in an investigation.
You can, of course, achieve more accurate and detailed results using a port scanner such as Nmap.
However, Netstat is already built in and the commands are quick and easy to use. You may also be interested in Microsoft’s Sysinternals Process Monitor tool, an advanced monitoring utility for Windows that shows real-time file system, Registry and process/thread activity.
*Note: The –b and –o options are not available on Windows 2000 and be aware that running them with the interval option would be a drain on a system’s resources.
About the author: Michael Cobb, CISSP-ISSAP is the founder and managing director of Cobweb Applications Ltd., a consultancy that offers IT training and support in data security and analysis. He co-authored the book IIS Security and has written numerous technical articles for leading IT publications.
