Working with the NETSTAT Command

Windows' NETSTAT command is a great utility for helping you to diagnose and repair TCP/IP problems. Although it will certainly never replace traditional diagnostic utilities like PING or TRACERT, NETSTAT is a welcome addition to the reportoire. Learn when and how to use NETSTAT in this article.

 By Brien M. Posey
Page 1 of 2
Print Article

When Windows has trouble communicating over a TCP/IP network, the common fix in the past was to use TCP/IP utilities such as PING and TRACERT to diagnose the problem. However, Windows XP takes network troubleshooting to a new level. While all of the standard TCP/IP troubleshooting utilities still exist in Windows XP, Microsoft has been kind enough to throw in several new troubleshooting utilities. In this article, we'll discuss one such utility -- the NETSTAT command.

The NETSTAT command is designed to help you quickly determine whether or not TCP/IP is working correctly. If TCP/IP is having problems, then NETSTAT can help you to determine where the problem is.

NETSTAT is a command line utility. To use this utility in its most basic form, you need only open a command prompt window and enter the command. When you do, NETSTAT will display a list of the current TCP/IP connections. The information presented on this screen includes the protocol (usually TCP), the local address (the MAC address), the foreign address (the IP address), and the connection state.

Entering the NETSTAT command with the -A switch causes the program to display all connections and listening ports. The result is a list that tells you which TCP and UDP ports that the machine is aware of, and which of those ports that the computer is presently listening to.

Sometimes, when you're troubleshooting a network problem, you may have questions as to whether any packets are flowing in or out of the machine at all. The NETSTAT command lets you quickly make such determinations when you enter the NETSTAT command with the -E parameter. The -E parameter tells NETSTAT to report the system's Ethernet statistics. You'll see information such as the number of bytes, unicast packets, non-unicast packets, discards, and errors that have been sent and received.

The cool thing about this utility is that it doesn't force you to treat TCP/IP as a single entity. TCP/IP is made up of many sub-protocols. If you enter the NETSTAT command with the -E and -S parameters, you can see a list of Ethernet statistics based on protocol. This means that you'll see the same list of sent and received bytes, unicast packets, etc., but this time, the list will be subdivided into categories such as IPv4, ICMPv4, TCP, and UDP.

This article was originally published on Dec 11, 2001
Get the Latest Scoop with Networking Update Newsletter