PDA

View Full Version : Netstat info



flying_green_leprachaun
24-02-2004, 02:56 AM
Proto Local Address Foreign Address State
TCP the-machine:4664 localhost:4665 ESTABLISHED
TCP the-machine:4665 localhost:4664 ESTABLISHED

this is a copy of a portion of a netstat log.

what might it mean that the local address is connecting to localhost like this?

ugh1
24-02-2004, 02:28 PM
What you are seeing is one process communicating with another using TCP.

This is not uncommon, one example is Internet Explorer, it will establixh local connections to communicate with the spyglass rendering engine, or your email client connecting with an antivirus email proxy.

flying_green_leprachaun
24-02-2004, 03:11 PM
AH! so much more sense to me now.

Now I just want to find out what they were....

/Thanks

Barnabas
24-02-2004, 04:25 PM
to find out what process they belong to use the -o switch
eg netstat -o

This will give you the process id number. Now press Ctrl Shift Esc to open the task manager. Simply match up the PID from netstat to the image name in the task manager to find out what they are. If you dont see a PID column (you should be looking under the processes tab) then click on view select columns and add PID.
Alternatively you can download fport which matches ports to apps in the command window.
B.

flying_green_leprachaun
24-02-2004, 10:38 PM
thats bloody handy,

thanks Barnabas.

flying_green_leprachaun
24-02-2004, 10:40 PM
Proto Local Address Foreign Address State PID
TCP the-machine:3316 localhost:3317 ESTABLISHED 440
TCP the-machine:3317 localhost:3316 ESTABLISHED 440

turns out its firefox.