Monitoring Network Connections with netstat

1. What is netstat?

netstat is a command-line tool used to display network connections for TCP (both incoming and outgoing), routing tables, and a number of network interface and network protocol statistics. It's a standard utility available on Windows, macOS, and Linux, making it a versatile first stop for network diagnostics.

Let's begin with a clear, animated overview of what netstat does and how to use its most common options.

2. Decoding netstat Output

As you saw in the video, running netstat displays a list of active connections with several columns. Let's formally define the most important ones.

3. Useful netstat Options

While netstat by itself is useful, its real power comes from combining it with options (or "switches") to filter the output. Since you have a computer science background, you'll find these options similar to flags used with other command-line tools like gcc or ls.

Here are some of the most common and useful options:

Common Combinations:

• netstat -an: This is a go-to command for a quick, comprehensive, and fast overview of all connections and listening ports.
• sudo netstat -anp: (On Linux/macOS) The "detective" command. It shows you everything numerically (-an) and tells you exactly which program is responsible for each connection (-p).
• netstat -anb: (On Windows) The equivalent detective command for Windows.

4. Understanding TCP Connection States

The State column in netstat's output is where our theoretical knowledge of the TCP lifecycle becomes tangible. When you see a state, it's a snapshot of where that connection is in its lifecycle.

Let's revisit the TCP state diagram to see the complete picture. All the states you see in netstat come from this process.

Here are the most common states you will encounter and what they mean:

• LISTEN: A server application is waiting for new connection requests on a specific port. For example, a web server will be in the LISTEN state on port 443. This corresponds to a program having called bind() and listen() in socket programming.
• ESTABLISHED: The three-way handshake is complete, and a connection is active. This is the state where data is being transferred, for example, while you are browsing a webpage.
• CLOSE_WAIT: The remote end of the connection has sent a FIN packet, indicating it's done sending data. Your machine has acknowledged it and is now waiting for the local application to close the connection from its side. You might see this briefly if a server closes a connection before your browser does.
• TIME_WAIT: Your end initiated the connection closure. The socket is kept in this state for a short period after closing to ensure any delayed packets from the old connection are handled correctly. This is a normal and healthy part of the TCP termination process.

Let's look at a real-world example.

5. Hands-On Practice

Now it's your turn to be the detective. Let's connect the dots on your own machine.

1. Prepare your environment: Close any unnecessary applications, but keep a single web browser window open.
2. Generate some traffic: In your browser, open tabs for two or three different websites (e.g., your school's homepage, a news site, etc.). These will primarily use HTTPS, which runs over TCP on port 443.
3. Run netstat: Open your command prompt (on Windows) or terminal (on Linux/macOS).
   • Type netstat -an and press Enter.
   • Look through the output. Can you find rows where the Proto is TCP and the State is ESTABLISHED?
   • In those rows, look at the Foreign Address. You should see IP addresses followed by :443. These are your connections to the web servers.
4. Identify the program:
   • On Windows: Run netstat -anb. (You may need to run Command Prompt as Administrator). Now, look at the same connections. Below each one, you should see the name of the program that created it, likely chrome.exe, firefox.exe, or similar.
   • On Linux/macOS: Run sudo netstat -anp. You'll be prompted for your password. The last column will show you the PID and program name (e.g., 12345/firefox).
5. Observe a state change:
   • Close one of the browser tabs you opened.
   • Immediately re-run the same netstat command from step 4.
   • Can you find the connection that was previously ESTABLISHED? It may have disappeared, or you might catch it in the TIME_WAIT state for a brief period before it vanishes completely. This demonstrates the connection termination process in action.

Conclusion

Congratulations! You've successfully used netstat to monitor your computer's live network connections and map them directly to the theoretical TCP states we've studied. This is a fundamental skill for any developer or system administrator when it comes to network troubleshooting.

Key Takeaways:

• netstat is a command-line tool for viewing network statistics.
• The -a (all), -n (numeric), and -p/-b (program) options are essential for getting a clear picture of network activity.
• The State column in the output shows the real-time status of a TCP connection (e.g., LISTEN, ESTABLISHED, TIME_WAIT).
• By using netstat, you can identify which applications on your machine are communicating over the network and with whom.

Preview of the Next Lesson:

In this lesson, we saw the status of a connection. In the next one, we'll go a level deeper using another powerful tool: Wireshark. Instead of just seeing that a connection is ESTABLISHED, you'll capture and inspect the actual SYN, SYN-ACK, and ACK packets that make up the TCP three-way handshake. This will give you a packet-by-packet view of how connections are born.