TechKnowSurge
CompTIA A+ Core 2 1.2 CompTIA Network+ 5.5 Cisco CCST Networking 5.3 Cisco CCNA 1.10
TechKnowSurge Catalog Videos DEMO: PC Connections
VideoNetworkFree

DEMO: PC Connections

Learn how to use the netstat command on Windows to view active TCP connections, including local addresses, remote endpoints, ports, and connection states.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

The netstat command is a built-in Windows utility that displays active network connections at the transport layer, commonly referred to as Layer 4. Running it from a command prompt returns a list of open TCP and UDP sessions, along with the local address and port, the remote address and port, and the current connection state for each entry. Because Windows initiates many background connections automatically — for services such as Windows Update and other system processes — the output typically contains a large number of entries even on an otherwise idle machine. Each connection entry reveals meaningful network information. The local address column shows which network interface and port the machine is using to establish the connection, while the remote address column identifies the destination host and port. Well-known port numbers are often displayed as their protocol names rather than numbers, so port 80 appears as HTTP. Connection states such as ESTABLISHED or TIME_WAIT indicate where a session stands in the TCP lifecycle, giving network and security professionals a snapshot of communication activity on the host at any given moment.

What you'll learn

What's covered

Viewing TCP Connections Windows

Aligned to

CompTIA A+ Core 2
1.2 Given a scenario, use the appropriate Microsoft command-line tool.
CompTIA Network+
5.5 Given a scenario, use the appropriate tool or protocol to solve networking issues.
Cisco CCST Networking
5.3 Run basic diagnostic commands and interpret the results.
Cisco CCNA
1.10 Verify IP parameters for Client OS

Key terms

Transmission Control Protocol
TCP
A connection-oriented transport protocol that ensures reliable, ordered, and error-checked delivery of data.
User Datagram Protocol
UDP
A connectionless transport protocol that sends data without establishing a connection or guaranteeing delivery.
Port
A logical endpoint for communication in a network, identified by a number that specifies a particular service or application.
IP Address
A numerical label assigned to each device connected to a network that uses the Internet Protocol.
Transport Layer
Layer 4 of the OSI model, responsible for end-to-end communication, flow control, and error recovery.
netstat
A command-line utility that displays active network connections, listening ports, and protocol statistics on a local system.

Transcript

Viewing Open TCP Connections on Windows

To view our TCP connections, all we have to do is open up a command prompt and type in netstat, and it's going to show us the connections that we have. It's going to show us quite a few — Windows sets up a lot of different connections right away to different devices out there.

I opened up our website to the Pi just to show you what that looks like. Here we see that things are still collecting. Once again, Windows is very chatty and it likes to go and make connections and get things like Windows updates, and there are other connections that this machine is making.

We see that most of the protocols here are TCP versus UDP. And then we also see the local address. Most of them are on the wireless interface here, because that's the one that makes the connection to the outside world. But we do see the one that I generated on the local interface right here. We see that it has 10.1.0.14, which is the static IP address I assigned to this machine. And it's using port 6309 — 60,39 is the port that it's using to reach out to this web server.

And then it is reaching out to 10.1.0.3 colon http, which just means it's replaced that port 80 with http, because that's the well-known port for HTTP, port 80. And then the state that it's in. We're not going to get real in depth into what the different states are here, but you can see that there are different states that are involved.

So there is how to look up the open TCP connections, or the open layer 4 connections, on your machine.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →