Netstat command

Updated: 11/12/2023 by Computer Hope
netstat command

The netstat command displays the TCP/IP network protocol statistics and information.

Availability

Netstat is an external command available for the following Microsoft operating systems as netstat.exe.

Netstat syntax

Windows 11 syntax

NETSTAT [-a] [-b] [-e] [-f] [-i] [-n] [-o] [-p proto] [-r] [-s] [-t] [-x] [-y] [interval]
-a Displays all connections and listening ports.
-b Displays the executable involved in creating each connection or listening port. Sometimes, well-known executables host multiple independent components, and in these cases, the sequence of components involved in creating the connection or listening port is displayed. In this case, the executable name is in [] at the bottom. Note that this option can be time-consuming and fails unless you have sufficient permissions.
-e Displays Ethernet statistics. This option may be combined with the -s option.
-f Displays FQDN (fully qualified domain names) for foreign addresses.
-i Displays the time spent by a TCP connection in its current state.
-n Displays addresses and port numbers in numerical form.
-o Displays the owning process ID associated with each connection.
-p proto Shows connections for the protocol specified by proto; proto may be any of: TCP, UDP, TCPv6, or UDPv6. If used with the -s option to display per-protocol statistics, proto may be any of: IP, IPv6, ICMP, ICMPv6, TCP, TCPv6, UDP, or UDPv6.
-r Displays the routing table.
-s Displays per-protocol statistics. By default, statistics are shown for IP, IPv6, ICMP, ICMPv6, TCP, TCPv6, UDP, and UDPv6; the -p option can specify a subset of the default.
-t Displays the current connection offload state.
-x Displays NetworkDirect connections, listeners, and shared endpoints.
-y Displays the TCP connection template for all connections. It cannot be combined with the other options.
interval Redisplays selected statistics, pausing interval seconds between each display. Press Ctrl+C to stop redisplaying statistics. If omitted, netstat prints the current configuration information once.

Windows Vista, 7, 8, and 10 syntax

NETSTAT [-a] [-b] [-e] [-f] [-n] [-o] [-p proto] [-r] [-s] [-x] [-t] [interval]
-a Displays all connections and listening ports.
-b Displays the executable involved in creating each connection or listening port. Sometimes, well-known executables host multiple independent components, and in these cases, the sequence of components involved in creating the connection or listening port is displayed. In this case, the executable name is in [] at the bottom. Note that this option can be time-consuming and fails unless you have sufficient permissions.
-e Displays Ethernet statistics. This option may be combined with the -s option.
-f Displays FQDN (fully qualified domain names) for foreign addresses.
-n Displays addresses and port numbers in numerical form.
-o Displays the owning process ID associated with each connection.
-p proto Shows connections for the protocol specified by proto; proto may be any of: TCP, UDP, TCPv6, or UDPv6. If used with the -s option to display per-protocol statistics, proto may be any of: IP, IPv6, ICMP, ICMPv6, TCP, TCPv6, UDP, or UDPv6.
-r Displays the routing table.
-s Displays per-protocol statistics. By default, statistics are shown for IP, IPv6, ICMP, ICMPv6, TCP, TCPv6, UDP, and UDPv6; the -p option can specify a subset of the default.
-t Displays the current connection offload state.
-x Displays NetworkDirect connections, listeners, and shared endpoints.
-y Displays the TCP connection template for all connections. It cannot be combined with the other options.
interval Redisplays selected statistics, pausing interval seconds between each display. Press Ctrl+C to stop redisplaying statistics. If omitted, netstat prints the current configuration information once.

Windows XP and earlier syntax

NETSTAT [-a] [-e] [-n] [-s] [-p proto] [-r] [interval]
-a Displays all connections and listening ports.
-e Displays Ethernet statistics. This option may be combined with the -s option.
-n Displays addresses and port numbers in numerical form.
-p proto Shows connections for the protocol specified by proto; proto may be TCP or UDP. If used with the -s option to display per-protocol statistics, proto may be TCP, UDP, or IP.
-r Displays the routing table.
-s Displays per-protocol statistics. By default, statistics are shown for TCP, UDP, and IP; the -p option can specify a subset of the default.
interval Redisplays selected statistics, pausing interval seconds between each display. Press Ctrl+C to stop redisplaying statistics. If omitted, netstat prints the current configuration information once.

Netstat examples

Tip

If you have network applications open, such as the Internet browser you are using to view this page, additional items are listed when running "netstat" and the "netstat -a" command. So you may see items from Computer Hope in your list. If you want a true listing of background Internet connections, close all programs and run the command. It is also normal to see one or more 0.0.0.0 and 127.0.0.1 addresses.

netstat

Displays all local network information. Below is an example of how this may look.

Proto	Local Address	Foreign Address				State
TCP	hope:4409		www.computerhope.com:telnet	ESTABLISHED
TCP	hope:3708		multicity.com:80		CLOSE_WAIT
TCP	hope:4750		www.google.com:80		CLOSE_WAIT
netstat -an

Displays all connections on the computers in numerical format, only displaying the local and foreign IP addresses.

netstat 5

Running netstat with a number after the command continues to run the command until stopped. In this case, netstat would be refreshed every five seconds. To cancel, press Ctrl+C.