Netstat -a help please

[Invisible§niper]

Hi again,

I have used netstat -a command in cmd, windows xp. Now what I wanted to know is what would this result mean from netstat -a command:

Proto Local Address Foriegn Address State

UDP Computer_Name:1900 *:*

Now I know that when you use the command "TRACERT" and you get asteriks it means that the traced computer is behind a firewall. But what do the "asterix, colon, asterix mean above when you use "netstat -A"?

[Scarecrow Man]

netstat is a command which displays the Network Status. the -a means active connections. You can also use switches such as -b for Browser.

For more help, see here or here

[homecomputeraid]

The asterisks appear on UDP ports. Since User Datagram Protocol (UDP) is connectionless, those columns are meaningless.

[Invisible§niper]

The asterisks appear on UDP ports. Since User Datagram Protocol (UDP) is connectionless, those columns are meaningless.

I mean I know that UDP is connectionless but I also UDP is a protocol that transmits data... so how do I tell where the data is going in that previous example I gave you ie the following example:

Proto Local Address Foriegn Address State

UDP Computer_Name:1900 *:*

How do I tell where the data is being transmitted too in that example since UDP is a form of sending data?

[homecomputeraid]

One of the easier ways is to use a free sniffer program like Ethereal. Remember to install winpcap before installing Ethereal. (I think it comes with it, but I'm not sure whether you still have to install it separately).

You can use netstat -o to see what application is associated with a particular connection. You'll get the Process ID (PID) number is using a particular connection. Once you have that, open Task Manager (the easiest way I know of to do that is to right click on an open area of your Task Bar and select Task Manager. In Windows Task Manager, click on the Processes tab. Then click View on the top menu and click on Select Columns, then place a check next to PID (Process Identifier). This will give you a PID column. Match that number with the PID you got using netstat -o, and that will tell you what executable (.exe) is using those ports. You can then do a search for the application and/or port number on Google and see whether it's spyware (if that's what you're checking).