First glance at Netstat TCP

Although TCP is recognized as a security protocol, it is essential for us to monitor it. Here we recommend some use of Netstat TCP. Next let's take a look at the specific content to learn how to manage Netstat TCP.

You can monitor the TCP connection status in the network trace under the Netstat TCP flag. You may also check the connection status by running the NETSTAT utility and checking the status column. NETSTAT works with Windows NT, Windows 95, and TCP/IP-32 for Windows.

Status description, as shown in Netstat:

SYN_SEND indicates that the activity is enabled.

The SYN_RECEIVED server only receives SYN from the client.

If a session is established, the SYN of the server received by the client establishes a session.

The listener server is ready to accept connections.

Note: See listen () SOCKET call. TCP socket is not displayed in the listening status-this is the limit of NETSTAT.

FIN_WAIT_1 indicates that the activity has ended.

The TIMED_WAIT client enters this status after the activity is disabled.

CLOSE_WAIT indicates passive shutdown. The server receives only the first FIN from the client.

The FIN_WAIT_2 client only receives the confirmation of its first FIN from the server.

When the LAST_ACK server is in this status, it will send its own FIN.

The server receives ACK from the client and closes the connection.

For the Netstat TCP monitoring example, consider the following:

The socket application is terminated, but Netstat reports the slot CLOSE_WAIT status. This may indicate that the client closes the sent FIN connection normally, but the server still has open sockets. This may be the result of an instance that does not close the socket between all threads or processes.

Note: It is a socket in the normal TIME_WAIT state of time that has a long time. In RFC793 at the specified time, it is used as the maximum survival time (MSL) for two times ). MSL is specified as 2 minutes. Therefore, the socket can be in the TIME_WAIT status for a maximum of 4 minutes. Some systems implement different values for MSL less than 2 minutes ).