> For the complete documentation index, see [llms.txt](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/zyberlab/06-network-security-basics/netstat-connections.md).

# Review Network Connections with netstat

This lab uses a built in Windows command to review listening ports and active connections on `CLIENT01`.

## Objective

Use `netstat` to identify local addresses, remote addresses, connection states, and process IDs.

## Run netstat

Open Command Prompt as an administrator on `CLIENT01` and run:

```
netstat -ano
```

Review these columns:

* Protocol
* Local Address
* Foreign Address
* State
* PID

## Focus on Active Connections

Look for entries with states such as:

```
ESTABLISHED
LISTENING
TIME_WAIT
```

`LISTENING` means a local service is waiting for incoming connections.

`ESTABLISHED` means an active TCP connection currently exists.

`TIME_WAIT` is a normal TCP state that can remain briefly after a connection closes.

## Map a PID to a Process

Choose one PID from the output and run:

```
tasklist /FI "PID eq <PID>"
```

Replace `<PID>` with the process ID you observed.

You can also use Task Manager to find the same process.

## Generate Simple Activity

Open a web browser on `CLIENT01` and visit a normal website.

Run `netstat -ano` again and compare the results.

You may see new outbound connections associated with the browser or supporting Windows processes.

## Verification

The lab is complete when you can identify one listening port, one active connection, and the process associated with at least one PID.

## Security Relevance

During an endpoint investigation, network connections help answer which process communicated with which destination. Combining connection information with Sysmon process and network events provides much better context than looking at either source alone.