Below, you see the partial listing of the output from the netstat command with the -a option. As you see, programs are listening -- waiting for input -- on various well-known ports:
C:\>netstat -a Active Connections Proto Local Address Foreign Address State TCP LPNewPortable:echo LPNewPortable:0 LISTENING TCP LPNewPortable:daytime LPNewPortable:0 LISTENING TCP LPNewPortable:qotd LPNewPortable:0 LISTENING TCP LPNewPortable:ftp LPNewPortable:0 LISTENING TCP LPNewPortable:smtp LPNewPortable:0 LISTENING TCP LPNewPortable:http LPNewPortable:0 LISTENING TCP LPNewPortable:https LPNewPortable:0 LISTENING ... |
Since the ports are well-known -- used by default for certain applications -- netstat is able to display the application name rather than the port number.
Next, I retrieved information from the Ford Web site. Two connections were established between the Web client on my machine (at ports 1756 and 1757) and the Web server at Ford. The Web server on my machine continued to listen for input:
C:\>netstat -a Active Connections Proto Local Address Foreign Address State TCP LPNewPortable:echo LPNewPortable:0 LISTENING TCP LPNewPortable:daytime LPNewPortable:0 LISTENING TCP LPNewPortable:qotd LPNewPortable:0 LISTENING TCP LPNewPortable:ftp LPNewPortable:0 LISTENING TCP LPNewPortable:smtp LPNewPortable:0 LISTENING TCP LPNewPortable:http LPNewPortable:0 LISTENING TCP LPNewPortable:https LPNewPortable:0 LISTENING TCP LPNewPortable:1756 www.ford.com:http ESTABLISHED TCP LPNewPortable:1757 www.ford.com:http ESTABLISHED ... |
Next, I retrieved a Web page from the server running on my own machine. There are connections from the client to the server and server to the client -- both on my machine at ports 1758 and 80. The Web server continued listening for other requests:
C:\>netstat -a Active Connections Proto Local Address Foreign Address State TCP LPNewPortable:echo LPNewPortable:0 LISTENING TCP LPNewPortable:daytime LPNewPortable:0 LISTENING TCP LPNewPortable:qotd LPNewPortable:0 LISTENING TCP LPNewPortable:ftp LPNewPortable:0 LISTENING TCP LPNewPortable:smtp LPNewPortable:0 LISTENING TCP LPNewPortable:http LPNewPortable:0 LISTENING TCP LPNewPortable:https LPNewPortable:0 LISTENING TCP LPNewPortable:http localhost:1758 ESTABLISHED TCP LPNewPortable:1758 localhost:http ESTABLISHED ... |
Finally, I started a second Web client and retrieved another page from the Web server running on my own machine:
C:\>netstat -a Active Connections Proto Local Address Foreign Address State TCP LPNewPortable:echo LPNewPortable:0 LISTENING TCP LPNewPortable:daytime LPNewPortable:0 LISTENING TCP LPNewPortable:qotd LPNewPortable:0 LISTENING TCP LPNewPortable:ftp LPNewPortable:0 LISTENING TCP LPNewPortable:smtp LPNewPortable:0 LISTENING TCP LPNewPortable:http LPNewPortable:0 LISTENING TCP LPNewPortable:https LPNewPortable:0 LISTENING TCP LPNewPortable:http localhost:1761 ESTABLISHED TCP LPNewPortable:http localhost:1764 ESTABLISHED TCP LPNewPortable:1761 localhost:http ESTABLISHED TCP LPNewPortable:1764 localhost:http ESTABLISHED ... C:\> |