I thought that the shell command netstat deserved a paper on it because it is pretty interesting but I don't know everything about it so here's what I know:
When you launch your cmd.exe 'command prompt' you have many, many commands that not many people know about. This one permits you to get the IP of someone connected to you.
At the command prompt, type netstat -all
You will get the following:
NETSTAT [-a] [-e] [-n] [-o] [-s] [-p proto] [-r] [interval]
-a Displays all connections and listening ports.
-e Displays Ethernet statistics. This may be combined with the -s
option.
-n Displays addresses and port numbers in numerical form.
-o Displays the owning process ID associated with each connection.
-p proto Shows connections for the protocol specified by proto; proto
may be any of: TCP, UDP, TCPv6, or UDPv6. If used with the -s
option to display per-protocol statistics, proto may be any of:
IP, IPv6, ICMP, ICMPv6, TCP, TCPv6, UDP, or UDPv6.
-r Displays the routing table.
-s Displays per-protocol statistics. By default, statistics are
shown for IP, IPv6, ICMP, ICMPv6, TCP, TCPv6, UDP, and UDPv6;
the -p option may be used to specify a subset of the default.
interval Redisplays selected statistics, pausing interval seconds
between each display. Press CTRL+C to stop redisplaying
statistics. If omitted, netstat will print the current
configuration information once.
Now that you know what they all do, type netstat -a
You will get something like this:
Active Connections
Proto Local Address Foreign Address State
TCP tip:epmap tip:0 LISTENING
TCP tip:microsoft-ds tip:0 LISTENING
TCP tip:1025 tip:0 LISTENING
TCP tip:1026 tip:0 LISTENING
TCP tip:3389 tip:0 LISTENING
TCP tip:4544 tip:0 LISTENING
TCP tip:5000 tip:0 LISTENING
TCP tip:3001 tip:0 LISTENING
TCP tip:3002 tip:0 LISTENING
TCP tip:3003 tip:0 LISTENING
TCP tip:3006 tip:0 LISTENING
TCP tip:4544 jimmyj.ircd:6667 ESTABLISHED
TCP tip:4568 logv17.xiti.com:http TIME_WAIT
TCP tip:4571 logv17.xiti.com:http TIME_WAIT
UDP tip:microsoft-ds *:*
UDP tip:isakmp *:*
UDP tip:3010 *:*
UDP tip:3021 *:*
UDP tip:3022 *:*
UDP tip:3810 *:*
UDP tip:1900 *:*
UDP tip:4557 *:*
UDP tip:1900 *:*
"LISTENING" means he is waiting for info on that port but hasn't connected yet.
"ESTABLISHED" means the connection is established (tough one, heh?)
"TIME_WAIT" means he is still waiting to establish a connection
the -n option is a good one : eg
Active Connections
Proto Local Address Foreign Address State
TCP 193.248.181.169:4544 67.130.99.243:6667 ESTABLISHED
TCP 193.248.181.169:4616 205.188.8.226:5190 ESTABLISHED
TCP 193.248.181.169:4621 205.188.250.25:80 TIME_WAIT
TCP 193.248.181.169:4627 64.236.46.56:80 ESTABLISHED
TCP 193.248.181.169:4628 64.236.46.56:80 ESTABLISHED
TCP 193.248.181.169:4629 64.12.164.153:80 ESTABLISHED
TCP 193.248.181.169:4630 64.12.164.153:80 CLOSE_WAIT
Basically, it simply displayes the address in numerical IP address format
I was running icq.
This command (netstat -n) allows you to get the IPs of people that are connected to you.
Now just look, dig and discover as I did you will find out that windows has much more then you think.
|
Copyright Open Source Institute, 2006 
