What is NETSTAT?


This article applies to:

  • Trustwave MailMarshal (SEG)
  • WebMarshal

Question:

What is NETSTAT?

 

Information:

You can use the NETSTAT command to check the operation of local ports to see if they are configured properly and if they are receiving data.

You can access a wealth of helpful information about the NETSTAT utility from the Help utility on your Microsoft Windows workstation or server. This information can be found by clicking START | HELP | INDEX and by entering the keyword netstat.

Port

Protocol

NETSTAT - WinNT

NETSTAT - UNIX

21

FTP

netstat -an 1 | findstr 21

netstat -an 1 | grep 21

25

SMTP

netstat -an 1 | findstr 25

netstat -an 1 | grep 25

53

DNS (Note 1)

netstat -an 1 | findstr 53

Netstat -an 1 | grep 53

80

HTTP

netstat -an 1 | findstr 80

netstat -an 1 | grep 80

99

WebTrends Remote Reporting

netstat -an 1 | findstr 99

netstat -an 1 | grep 99

110

POP3

netstat -an 1 | findstr 110

netstat -an 1 | grep 110

137

WINS (Note 2)

netstat -an 1 | findstr 137

netstat -an 1 | grep 137

514

SYSLOG

netstat -an 1 | findstr 514

netstat -an 1 | grep 514

18184

OPSEC LEA

netstat -an 1 | findstr 18184

netstat -an 1 | grep 18184
  • Note 1: DNS is the acronym for Domain Name Service, a name resolution scheme that originated with the Berkeley version of Unix. DNS is used throughout the Internet for host-name resolution and is a constantly evolving protocol. Along with host-name resolution, it helps in e-mail routing and other TCP/IP-based application services. The most popular Unix-based implementation of DNS is the Berkeley Internet Name Daemon, or BIND.
    • SEG/MailMarshal SMTP uses DNS port 53 TCP and UDP.
  • Note 2: WINS is the acronym for Windows Internet Naming Service, Microsoft's extension of the NetBIOS name resolution scheme. Computers utilize port 137 for WINS resolution.
    • If WINS resolution is enabled, local machine names can be resolved without explicit DNS entries.

Once you type the command, look for a response:

     

  • If nothing appears, the port is not being utilized.
    • If you are checking the response from a Marshal product, check to see if the appropriate service is running. If it is, you may need to restart the server computer and run NETSTAT again.

  • If the word "ESTABLISHED" appears, then the port is configured properly and it is receiving data.

     

  • If the words "TIME-WAIT" appear, the port is configured properly but it is not receiving data.

This article was previously published as: entries
NETIQKB2609

Last Modified 4/1/2020.
https://support.trustwave.com/kb/KnowledgebaseArticle10875.aspx