Windows 95 Netstat Utility and TCP/IP Connections

In Windows 95, monitoring active network traffic and inspecting open ports was handled primarily by the built-in command-line tool netstat.exe, executed via the MS-DOS Prompt. This article explains how Netstat functioned within Windows 95, how users accessed it to inspect their network state, and the primary command parameters used to analyze active TCP/IP connections.

The MS-DOS Prompt and Netstat.exe

Windows 95 introduced native 32-bit TCP/IP networking, bundling several diagnostic utilities ported from Unix and earlier network environments. The utility responsible for viewing active connections was netstat.exe (short for Network Statistics).

Because Windows 95 did not provide a graphical user interface (GUI) for connection monitoring, users accessed the tool through the MS-DOS Prompt (located under Start > Programs > MS-DOS Prompt, running COMMAND.COM). While other utilities like winipcfg.exe provided a graphical display for adapter configurations and IP addresses, netstat.exe remained strictly a command-line tool for reading the status of the Windows Sockets (Winsock) subsystem.

How to Use Netstat in Windows 95

To view connection details, users typed netstat followed by optional command switches into the command line. When run without parameters, netstat displayed all active, established TCP connections along with their local and remote IP addresses or hostnames.

The utility supported several key flags to modify its output:

  • netstat -a: Displays all active connections and listening TCP and UDP ports. This was the standard command used to check whether a machine was actively listening for incoming services.
  • netstat -n: Displays addresses and port numbers in numerical form. By default, Netstat attempted reverse DNS lookups, which could cause significant delays over slow dial-up connections; adding -n prevented this overhead.
  • netstat -e: Displays Ethernet statistics, detailing total bytes, packets, errors, and discards sent and received across network adapters.
  • netstat -r: Displays the IP routing table and active routes, showing how outgoing packets were directed through gateways.
  • netstat -s: Displays detailed per-protocol statistics for IP, ICMP, TCP, and UDP traffic.
  • netstat -p [protocol]: Filters the displayed connections to a specific protocol, such as TCP or UDP.

Interpreting Connection States

When outputting active sockets, netstat.exe reported the standard TCP state machine values, helping users diagnose connection problems or detect unauthorized communication:

  • ESTABLISHED: The connection is open and active between the local host and remote host.
  • LISTENING: The local port is open and waiting for incoming connection requests.
  • TIME_WAIT: The connection has closed, but the socket remains temporarily reserved to ensure delayed packets are processed.
  • CLOSE_WAIT: The remote endpoint has shut down the connection, and the local endpoint is waiting to close it completely.
  • SYN_SENT: An active attempt is underway to establish a connection with a remote server.