The netstat command, short for Network Statistics, is a built-in Windows utility that displays active connections, open listening ports, routing tables, and per-protocol statistics. It runs from any Command Prompt window without any third-party software and works on every version of Windows. Security-conscious users and administrators run it to detect suspicious open ports, identify which applications are communicating over the network, and verify that expected services are listening correctly.
This guide explains every netstat flag with real examples so you can read its output confidently and combine it with tools like ipconfig and ping for complete network diagnostics.
Quick Answer
Open Command Prompt and run netstat -a to see all active connections and listening ports. Add -n to display IP addresses numerically for faster output. Use -o to include the Process ID so you can match connections to apps in Task Manager. Run netstat -ano to get all three at once.
How to Use the netstat Command in Windows
The basic netstat syntax in Windows is:
netstat [-a] [-b] [-e] [-f] [-i] [-n] [-o] [-p proto] [-r] [-s] [-t] [-x] [-y] [interval]Run netstat /? from Command Prompt to print the full flag reference directly to your terminal:
netstat /?
Show All Connections: netstat -a
The -a flag lists all listening ports and connections, including both active and inactive ones. Use it when you want a complete snapshot of your system’s network activity:
netstat -a
The output columns mean the following:
- Proto shows the protocol in use (TCP or UDP).
- Local Address shows the local IP address and port number.
- Foreign Address shows the remote IP address your system is connected to.
- State shows the current connection state such as LISTENING, ESTABLISHED, or TIME_WAIT.
Show Connections With Processes: netstat -b
The -b flag adds the executable name responsible for each connection. Run this as administrator to identify which application is using a specific port. It is the fastest way to spot an unfamiliar program listening on your machine:
netstat -b
Note: The netstat -b command requires elevated (administrator) privileges. Running it without elevation returns an access error.
View Port Consumption by Protocol: netstat -c
The -c flag shows the number of ports consumed by each protocol against specific programs. It provides a breakdown of how network ports are distributed across running processes:
netstat -c
View DSCP Values: netstat -d
DSCP (Differentiated Services Code Point) values determine how network devices prioritize and route packets. The -d flag shows this value for each active connection, which is useful in environments where quality-of-service policies are in place:
netstat -d
View Ethernet Interface Statistics: netstat -e
The -e flag shows Ethernet statistics: total bytes and packets sent and received by your network adapter. It is useful for spotting abnormally high traffic volumes that could indicate a network issue or unexpected data transfer:
netstat -e
Show Fully Qualified Domain Names: netstat -f
The -f flag resolves foreign IP addresses to their fully qualified domain names (FQDN). This makes the connection list easier to scan because you see hostnames instead of raw IP numbers:
netstat -f
View TCP Connection Duration: netstat -i
The -i flag adds a column showing how long each TCP connection has been in its current state. Long-lived connections in TIME_WAIT can indicate connection handling issues in a server application:
netstat -i
Show Numerical Addresses: netstat -n
The -n flag skips DNS resolution and displays IP addresses and ports as numbers. This produces output much faster when you have many connections, since netstat does not wait for hostname lookups:
netstat -n
Show PID for Each Connection: netstat -o
The -o flag adds a PID (Process ID) column to the output. Take the PID shown, open Task Manager with Ctrl + Shift + Esc, and find that number in the Details tab to identify the exact application. This is the most direct way to find which app owns a suspicious connection. To terminate it from the terminal, use the taskkill command with taskkill /PID <number> /F:
netstat -o
Filter by Protocol: netstat -p TCP
The -p flag followed by a protocol name shows only connections for that protocol. Accepted values are TCP, UDP, TCPv6, and UDPv6. Use it to isolate issues with a specific protocol type and reduce the amount of output you need to scan:
netstat -p TCP
Show All Connections Including Bound Ports: netstat -q
The -q flag shows all connections, listening ports, and bound non-listening TCP ports. It reveals ports that are bound but not yet in a LISTENING state, helping identify applications that are starting up or that failed to initialize cleanly:
netstat -q
View the Routing Table: netstat -r
The -r flag displays the routing table, showing how your system routes outbound traffic across your network interfaces. It also includes the interface list at the top. The same information is available from route print, but netstat -r combines both views:
netstat -r
View Per-Protocol Statistics: netstat -s
The -s flag shows detailed statistics for every protocol including TCP, UDP, IP, and ICMP. The output includes totals for packets sent and received, errors, and discards. Combine it with -p to narrow the output to one protocol, for example netstat -s -p TCP:
netstat -s
Check TCP Chimney Offload State: netstat -t
TCP Chimney Offload moves TCP connection processing from the CPU to the network adapter firmware. The -t flag adds an Offload State column. Most modern systems show InHost for all connections, meaning offloading is not active:
netstat -t
Most Useful netstat Combinations
Most real-world troubleshooting uses combined flags. Running netstat -ano is the most common combination: -a includes all connections, -n produces fast output by skipping DNS resolution, and -o adds PIDs. Appending a number refreshes the output automatically every N seconds. Press Ctrl + C to stop:
netstat -ano 5If you spot a suspicious PID, cross-reference it in Task Manager or terminate the process directly using the taskkill command. For network-path troubleshooting, pair netstat with the tracert command to trace exactly which hops traffic takes to reach a remote host.