View Active TCP/IP Connections in Windows 98

In Microsoft Windows 98, monitoring network activity was an essential diagnostic task for troubleshooting Internet issues and checking for unauthorized access. This article explains the primary command-line utility used to view active TCP/IP connections, how users accessed it, and the essential command parameters available in the Windows 98 operating system.

The Netstat Utility

The utility used to view active TCP/IP connections in Windows 98 is Netstat (short for Network Statistics). Included as a native command-line tool, Netstat allowed users to inspect inbound and outbound connections, identify open network ports, and analyze network protocol statistics.

While Windows 98 included graphical tools like winipcfg for displaying IP addresses and adapter configurations, Netstat was the only built-in tool capable of displaying real-time connection states and active socket connections.

How to Access Netstat in Windows 98

To use Netstat in Windows 98, users had to access the MS-DOS Prompt:

  1. Click the Start button.
  2. Navigate to Programs.
  3. Click MS-DOS Prompt.
  4. Type netstat followed by any desired command switches and press Enter.

Common Netstat Commands and Parameters

Running the basic netstat command displayed a list of currently active TCP connections. However, several command-line switches provided more detailed information:

  • netstat -a: Displays all active connections and the TCP and UDP ports on which the computer is currently listening.
  • netstat -n: Displays addresses and port numbers in numerical form instead of attempting to resolve hostnames via DNS.
  • netstat -e: Displays Ethernet statistics, such as the total number of bytes and packets sent and received.
  • netstat -r: Displays the IP routing table and active routes.
  • netstat -s: Displays detailed protocol-by-protocol statistics for TCP, UDP, ICMP, and IP.
  • netstat -p [protocol]: Filters output to show connections for a specific protocol (such as TCP or UDP).

Understanding the Output

When executed, the standard Netstat output organized data into four primary columns:

  • Proto: The protocol used by the connection (typically TCP or UDP).
  • Local Address: The local computer's IP address and the port number being used.
  • Foreign Address: The remote computer's IP address and port number.
  • State: The current status of the TCP connection (such as ESTABLISHED, LISTENING, TIME_WAIT, or CLOSE_WAIT).