Skip to main content

LevelBlue Completes Acquisition of Cybereason.  Learn More

LevelBlue Completes Acquisition of Cybereason.  Learn More

Services
Cyber Advisory
Managed Cloud Security
Data Security
Managed Detection & Response
Email Security
Managed Network Infrastructure Security
Exposure Management
Security Operations Platforms
Incident Readiness & Response
SpiderLabs Threat Intelligence
Solutions
BY TOPIC
Offensive Security
Solutions to maximize your security ROI
Operational Technology
End-to-end OT security
Microsoft Security
Unlock the full power of Microsoft Security
Securing the IoT Landscape
Test, monitor and secure network objects
Why LevelBlue
About Us
Awards and Accolades
LevelBlue SpiderLabs
LevelBlue Security Operations Platforms
Security Colony
Partners
Microsoft Security
Unlock the full power of Microsoft Security
Technology Alliance Partners
Key alliances who align and support our ecosystem of security offerings
Loading...
Loading...

INFO: What is NETSTAT?

Expand / Collapse


This article applies to:

  • Trustwave MailMarshal (SEG)
  • WebMarshal

Question:

What is NETSTAT?

 

Information:

You can use the NETSTAT command to check the operation of local ports to see if they are configured properly and if they are receiving data.

You can access a wealth of helpful information about the NETSTAT utility from the Help utility on your Microsoft Windows workstation or server. This information can be found by clicking START | HELP | INDEX and by entering the keyword netstat.

Port

Protocol

NETSTAT - WinNT

NETSTAT - UNIX

21

FTP

netstat -an 1 | findstr 21

netstat -an 1 | grep 21

25

SMTP

netstat -an 1 | findstr 25

netstat -an 1 | grep 25

53

DNS (Note 1)

netstat -an 1 | findstr 53

Netstat -an 1 | grep 53

80

HTTP

netstat -an 1 | findstr 80

netstat -an 1 | grep 80

99

WebTrends Remote Reporting

netstat -an 1 | findstr 99

netstat -an 1 | grep 99

110

POP3

netstat -an 1 | findstr 110

netstat -an 1 | grep 110

137

WINS (Note 2)

netstat -an 1 | findstr 137

netstat -an 1 | grep 137

514

SYSLOG

netstat -an 1 | findstr 514

netstat -an 1 | grep 514

18184

OPSEC LEA

netstat -an 1 | findstr 18184

netstat -an 1 | grep 18184

  • Note 1: DNS is the acronym for Domain Name Service, a name resolution scheme that originated with the Berkeley version of Unix. DNS is used throughout the Internet for host-name resolution and is a constantly evolving protocol. Along with host-name resolution, it helps in e-mail routing and other TCP/IP-based application services. The most popular Unix-based implementation of DNS is the Berkeley Internet Name Daemon, or BIND.
    • SEG/MailMarshal SMTP uses DNS port 53 TCP and UDP.
  • Note 2: WINS is the acronym for Windows Internet Naming Service, Microsoft's extension of the NetBIOS name resolution scheme. Computers utilize port 137 for WINS resolution.
    • If WINS resolution is enabled, local machine names can be resolved without explicit DNS entries.

Once you type the command, look for a response:

     

  • If nothing appears, the port is not being utilized.
    • If you are checking the response from a Marshal product, check to see if the appropriate service is running. If it is, you may need to restart the server computer and run NETSTAT again.
  • If the word "ESTABLISHED" appears, then the port is configured properly and it is receiving data.

     

  • If the words "TIME-WAIT" appear, the port is configured properly but it is not receiving data.

This article was previously published as: entries
NETIQKB2609

To contact Trustwave about this article or to request support:


Rate this Article:
     
Tags:

Add Your Comments


Comment submission is disabled for anonymous users.
Please send feedback to Trustwave Technical Support or the Webmaster
.