View Active TCP/IP Connections in Windows XP

In Windows XP, users and administrators rely on the native netstat command-line utility to monitor active network activity and diagnose connectivity issues. This article explains how to access and utilize netstat to display active TCP/IP connections, view open listening ports, and identify the exact programs responsible for network traffic.

The Netstat Utility

The command-line utility used to view active TCP/IP connections in Windows XP is netstat (short for Network Statistics). It is pre-installed with the operating system and runs directly from the Windows Command Prompt without requiring third-party software.

To open the tool:

  1. Click Start and select Run.
  2. Type cmd and press Enter to open the Command Prompt.
  3. Type netstat and press Enter.

By default, typing netstat alone displays a list of active TCP connections, showing the protocol, local address, foreign address, and the current connection state (such as ESTABLISHED or CLOSE_WAIT).

Key Parameters and Switches

Windows XP enhanced the netstat command by introducing several powerful flags that provide deeper visibility into network sockets:

  • netstat -a: Displays all active TCP connections as well as the TCP and UDP ports on which the computer is listening (LISTENING).
  • netstat -n: Displays addresses and port numbers in numerical form instead of attempting to resolve them to hostnames and known service names, which significantly speeds up the output.
  • netstat -o: Displays the Process Identifier (PID) associated with each connection. You can match this PID with the Process tab in Windows Task Manager to find the exact application using the port.
  • netstat -b: Introduced in Windows XP Service Pack 2, this switch displays the actual executable component (e.g., iexplore.exe or svchost.exe) involved in creating each connection or listening port.
  • netstat -e: Displays Ethernet statistics, such as bytes sent and received.
  • netstat -r: Displays the IP routing table.

Common Usage Examples

To see all active connections and listening ports with numerical IP addresses and their associated Process IDs, enter:

netstat -ano

To see which executable files are communicating over the network in real time, run:

netstat -b

To continuously refresh the connection list every few seconds (for example, every 5 seconds), append an interval to the end of the command:

netstat -an 5

Press Ctrl + C at any time to stop the continuous output.