IP_NetStat Commands Every Network Admin Should Know

IP_NetStat Commands Every Network Admin Should Know

Overview

IP_NetStat is a command-line tool for viewing and managing IP network connections and routing on Windows. It shows active TCP/UDP endpoints, listening ports, route table, interface statistics, and protocol-specific details.

Common and essential commands

• ipconfig /all — detailed IP configuration for all adapters (useful alongside NetStat).
• netstat -an — list all active TCP/UDP connections and listening ports with numeric addresses.
• netstat -ano — same as -an plus process ID (PID) for each connection.
• netstat -b — shows the executable involved in creating each connection (requires admin).
• netstat -e — Ethernet statistics (bytes, packets, errors).
• netstat -s — per-protocol statistics (TCP, UDP, ICMP).
• netstat -r — display the routing table (same as route print).
• netstat -p tcp / netstat -p udp — filter by protocol.
• netstat -f — shows fully qualified domain names for foreign addresses.
• netstat -t — display the current TCP connection timer information (on some platforms).

Practical examples (Windows)

• Find which process is using port 80:
  netstat -ano | findstr :80

  then match the PID in Task Manager or:

  tasklist /FI “PID eq ”

• Show per-protocol errors:
  netstat -s

When to use which command

• Quick port check: netstat -an
• Identify owning process: netstat -ano or netstat -b (admin)
• Diagnose interface/routing issues: netstat -e, netstat -r
• Gather protocol-level stats: netstat -s

Tips

• Run elevated (Administrator) to see process/executable info.
• Combine with ipconfig, tasklist, and Resource Monitor for full diagnostics.
• Use piping and findstr to filter results on Windows; use grep on Unix-like systems (netstat exists there too with slightly different flags).

Alternatives

• Modern Windows: use PowerShell cmdlets like Get-NetTCPConnection, Get-NetUDPEndpoint, and Get-NetRoute for richer, scriptable output.