View Full Version : Netstat info

24-02-2004, 02:56 AM
Proto Local Address Foreign Address State
TCP the-machine:4664 localhost:4665 ESTABLISHED
TCP the-machine:4665 localhost:4664 ESTABLISHED

this is a copy of a portion of a netstat log.

what might it mean that the local address is connecting to localhost like this?

24-02-2004, 02:28 PM
What you are seeing is one process communicating with another using TCP.

This is not uncommon, one example is Internet Explorer, it will establixh local connections to communicate with the spyglass rendering engine, or your email client connecting with an antivirus email proxy.

24-02-2004, 03:11 PM
AH! so much more sense to me now.

Now I just want to find out what they were....


24-02-2004, 04:25 PM
to find out what process they belong to use the -o switch
eg netstat -o

This will give you the process id number. Now press Ctrl Shift Esc to open the task manager. Simply match up the PID from netstat to the image name in the task manager to find out what they are. If you dont see a PID column (you should be looking under the processes tab) then click on view select columns and add PID.
Alternatively you can download fport which matches ports to apps in the command window.

24-02-2004, 10:38 PM
thats bloody handy,

thanks Barnabas.

24-02-2004, 10:40 PM
Proto Local Address Foreign Address State PID
TCP the-machine:3316 localhost:3317 ESTABLISHED 440
TCP the-machine:3317 localhost:3316 ESTABLISHED 440

turns out its firefox.