In this video, we have NetStat.
NetStat is short for network statistics.
NetStat is going to be used to display information
for IP-based connections on a client,
including its current sessions,
its source and destination IPs, and its port numbers.
Now, NetStat is used in Windows, Linux, UNIX,
and OS X systems.
You can just enter NetStat by itself and hit Enter,
and you'll get a simplified display
that contains four columns of information.
This includes the protocol, the local address,
the foreign address, and the state.
In this example, all of my connections
are using TCP as their protocol.
There are two local addresses in my example.
The local host of 127.0.0.1,
and my network interface card, which is 192.168.105.3.
Notice each of these has a colon
and a port number after it.
Next, we have the foreign address
or the destination address.
In this case, the local host address,
they cannot communicate with other foreign IPs,
so instead they're communicating directly
with the Windows client itself.
And this is using my host name for this Windows machine.
For the other foreign addresses,
if the host name is known, it will resolve to that host name
like diontraining.com.
If not, it'll just show the IP address.
You can see here that 52.179.224.121
was not able to be resolved to a host name.
So that IP address is shown here on the screen.
Since this was using Port 443,
this is displayed as HTTPS instead
because this is a well-known port number.
Finally, we have the state column.
This can be established, time wait, close wait,
closed, listening, or other TCP connection states.
Notice here we didn't see any listening ports.
This is because we just entered the command NetStat.
If instead we entered NetStat dash a,
we're going to show all the sockets,
both listening and non listening, as well as all protocols
such as TCP, UDP, and ICMP.
Again, here we can also see IPs are resolved
to host names when it's possible.
Now, if you prefer to see all IP address numbers
instead of those host names, you can do this
by entering the NetStat dash n command.
But since I only used the dash n option,
I'm no longer going to see the listening status anymore.
Now, what would you do if you want to have
both the IP address numbers and the listening status?
Well, you combine the two options
and you get NetStat dash an.
Now, personally, when I run NetStat,
I tend to run it using NetStat dash ano.
This gives me all the states,
both listening and non listening, because of the dash a,
as well as the IP address numbers,
because I have that dash n,
but I also added this dash o,
which gives me a fifth column called the PID.
Now, PID is the process identification number
and the dash o I added in the dash an o stands for owner,
and it's going to tell me which process owns
each network connection that we're seeing.
Now by adding this fifth column,
I can determine what application or service is communicating
over the network, using which IPs and which ports.
Then if I run the task list command,
I can get a list of all the applications
and their PID numbers.
In my case, I see a bunch of network connections
were created by the application with PID 6776.
As I look at my output from the task list command,
I can then cross reference it
and see that PID 6776 is the application GoogleDriveFS.exe,
which is the file synchronization process
for Google Drive on this Windows workstation.
So this makes a lot of sense
that I'm seeing a lot of network connections on the system
using this process ID because it sends a lot of files
and receives a lot of files using Google Drive
as I'm syncing up data.
Now, if I suspect a client is infected with malware
or may have become a zombie as part of a botnet,
I can run the NetStat dash ano command
and really help identify what applications or services
are creating all these connections
and sending data back and forth.
Then I can use this information
to remove those malicious programs.
Now, the final option we have with NetStat
is known as the dash s option, which stands for statistics.
Now, this is going to create an output on your screen
with the statistics for the IPv4, IPv6,
ICMPv4, and ICMPv6 connections,
as well as breaking down those statistics into TCP
and UDP statistics for both IPv4 and IPv6.
This information can be used
to help you determine the health of your network connection
by showing you how many packets were delivered,
how many were discarded, how many couldn't be routed,
how many had errors,
and how many were fragmented during transit.
Overall, this information is really helpful
as you create your baselines
for what normal looks like on a given client.
Then you can use that as your baseline
and compare your current stats against that baseline
to see if you have any unexpected results.