[Windows] netstate command status Parsing

[Windows] netstate command status Parsing

 

1. Listening status

After the FTP service is started, it is in the listening status.

When the State is displayed as listening, it indicates that the port is in the listening state, that is, it is open and waiting for connection, but it is not connected yet. Just as the door of your house has been opened, but no one has come in.

The tcpview shows that FTP is enabled on the local machine. It means that the program inetinfo.exe opens port 21, and the default FTP port is port 21. It can be seen that the FTP service is opened on the local machine. It is currently in the listening status.

Inetinfo.exe: 1260 TCP 0.0.0.0: 21 0.0.0.0: 0 listening

2. established status

Access the FTP service of 192.168.1.10 from the computer 192.168.1.1. The tcpview on the local machine shows that the port status changes to established.

Established means to establish a connection. The two machines are communicating.

The following shows that the local FTP service is being accessed by the computer 192.168.1.1.

Inetinfo.exe: 1260 TCP 192.168.1.10: 21 192.168.1.1: 3009 established

Note: You must pay special attention to the connection in the established status, because it may not be a normal connection. We will discuss this issue later.

3. time_wait status

Now, access to the FTP service of 192.168.1.10 is terminated from 192.168.1.1. The tcpview on the local machine shows that the port status changes to time_wait.

Time_wait indicates that the connection has ended. Port 21 has been accessed, but the access is over.

[System process]: 0 TCP 192.168.1.10: 21 192.168.1.1: 3009 time_wait

4. syn_sent status

The syn_sent status indicates a request for connection. When you want to access the services of other computers, you must first send a synchronous signal to this port. The status is syn_sent. If the connection is successful, it becomes established, at this time, the syn_sent status is very short. However, if syn_sent is found to be very large and is being sent to different machines, your machine may be infected with viruses such as shock waves or shock waves. To infect other computers, these viruses need to scan other computers and send synchronous requests to each computer to be scanned during the scanning process, which is also the cause of many syn_sent attacks.

The following shows the Starting Status of the local connection to www.baidu.com. If your network is normal, it will soon become the connection status of established.

Iw.e. EXE: 2928 TCP 192.168.1.10: 1035 202.108.250.249: 80 syn_sent

5. Tips

A. You can telnet an open port to observe its changes. For example, if port 1025 is open, run the following command in command status (1. Run cmd:

Telnet 192.168.1.10 1025.

B. It can also be tested from the local machine, but the display is that the local machine is connected to the Local Machine

C. Double-click the connection in tcpview to view the program location. Right-click the connection and select end process to end the connection.
5) client port status changes

The client port is actually the source port opened when accessing other computer services from the local machine. The most common application is internet access. The following uses accessing Baidu.com as an example to check the port opening and status changes.