Microsoft DOS netstat command

Quick links

About netstat
Availability
Syntax
Examples

About netstat

The netstat command is used to display the TCP/IP network protocol statistics and information.

Availability

The netstat.exe command is an external command available in the below Microsoft operating systems.

Windows 95
Windows 98
Windows NT
Windows ME
Windows 2000
Windows XP
Windows Vista
Windows 7
Windows 8

Syntax

Windows Vista and later syntax
Windows XP and earlier syntax

Windows Vista and later syntax

NETSTAT [-a] [-b] [-e] [-f] [-n] [-o] [-p proto] [-r] [-s] [-x] [-t] [interval]

-a Displays all connections and listening ports.
-b Displays the executable involved in creating each connection or listening port. In some cases well-known executables host multiple independent components, and in these cases the sequence of components involved in creating the connection or listening port is displayed. In this case the executable name is in [] at the bottom, on top is the component it called, and so forth until TCP/IP was reached. Note that this option can be time-consuming and will fail unless you have sufficient permissions.
-e Displays Ethernet statistics. This may be combined with the -s option.
-f Displays Fully Qualified Domain Names (FQDN) for foreign addresses.
-n Displays addresses and port numbers in numerical form.
-o Displays the owning process ID associated with each connection.
-p proto Shows connections for the protocol specified by proto; proto may be any of: TCP, UDP, TCPv6, or UDPv6. If used with the -s option to display per-protocol statistics, proto may be any of: IP, IPv6, ICMP, ICMPv6, TCP, TCPv6, UDP, or UDPv6.
-r Displays the routing table.
-s Displays per-protocol statistics. By default, statistics are shown for IP, IPv6, ICMP, ICMPv6, TCP, TCPv6, UDP, and UDPv6; the -p option may be used to specify a subset of the default.
-t Displays the current connection offload state.
-x Displays NetworkDirect connections, listeners, and shared endpoints.
-y Displays the TCP connection template for all connections. Cannot be combined with the other options.
interval Redisplays selected statistics, pausing interval seconds between each display. Press CTRL+C to stop redisplaying statistics. If omitted, netstat will print the current configuration information once.

Windows XP and earlier syntax

NETSTAT [-a] [-e] [-n] [-s] [-p proto] [-r] [interval]

-a Displays all connections and listening ports.
-e Displays Ethernet statistics. This may be combined with the -s option.
-n Displays addresses and port numbers in numerical form.
-p proto Shows connections for the protocol specified by proto; proto may be TCP or UDP. If used with the -s option to display per-protocol statistics, proto may be TCP, UDP, or IP.
-r Displays the routing table.
-s Displays per-protocol statistics. By default, statistics are shown for TCP, UDP, and IP; the -p option may be used to specify a subset of the default.
interval Redisplays selected statistics, pausing interval seconds between each display. Press CTRL+C to stop redisplaying statistics. If omitted, netstat will print the current configuration information once.

Examples

Tip: Keep in mind that if you have network applications open, such as the Internet browser you're using to view this page, additional items will be listed when you run "netstat" and the "netstat -a" command. So you may see items from Computer Hope in your list. If you want a true listing of background Internet connections, close all programs and run the command. Finally, it is also normal to see one or more 0.0.0.0 and 127.0.0.1 addresses.

netstat

Displays all local network information. Below is an example of how this may look.

Proto Local Address Foreign Address State
 TCP hope:4409 www.computerhope.com:telnet ESTABLISHED
 TCP hope:3708 multicity.com:80 CLOSE_WAIT
 TCP hope:4750 www.google.com:80 CLOSE_WAIT

netstat -an 

Displays all connections on the computers in numerical format, only displaying the local and foreign IP addresses.

netstat 5

Running netstat with a number after the command will continue to run the command until stopped. In this case netstat would be refreshed ever five seconds. To cancel press CTRL + C.