Which Command Line Utility is Used to Display Active Network Connections on a PC?

In the world of networking and system administration, understanding network connections is crucial for troubleshooting and monitoring. When a system experiences network-related issues, administrators often turn to command-line tools to analyze and resolve the problem. One such essential utility is the command line utility used to display active network connections.

For users of Windows, Linux, and macOS, the method to display active network connections may vary, but the need for such data remains the same. Whether you're a network administrator, a cybersecurity expert, or just someone curious about your device’s network connections, this guide will explore the most commonly used tools to display active network connections, how to use them, and their importance in the larger context of system and network management.

What Are Active Network Connections?

Active network connections refer to the established communication channels between your PC and other devices across a network. These connections can be:

TCP connections: Used for reliable communication between systems.
UDP connections: Generally used for faster but less reliable communication.
Sockets: These are the endpoints used for these communications.

When a device establishes a connection, it assigns a local IP address and a specific port number. Monitoring these active connections helps administrators and users track and manage network activity, detect malicious behavior, and optimize performance.

Command Line Utilities to Display Active Network Connections

1. Netstat (Network Statistics)

Netstat is the most commonly used command-line utility to display active network connections on a PC. It is available on Windows, Linux, and macOS. Netstat provides detailed information about network protocols, IP addresses, and port numbers in use on the system.

How to Use Netstat:

Windows:

o Open Command Prompt by pressing Win + R, typing cmd, and pressing Enter.

o In the command prompt, type:

netstat -an

This command displays all active connections and their statuses.

o To show the listening ports, you can use:

netstat -an | find "LISTEN"

Linux/macOS:

o Open the terminal.

o To view active network connections, type:

netstat -tuln

This will show you the listening TCP and UDP ports.

o If you need to see connections with the process name, use:

netstat -tulnp

Netstat is an excellent utility because of its simplicity and ability to show both active and listening connections. It can also display information on the protocol, local address, foreign address, and the state of each connection.

2. ss (Socket Stat)

The ss command is another utility that is faster and more informative than netstat, particularly on Linux systems. It's part of the iproute2 package and provides more detailed information on active connections.

How to Use ss:

Linux:

Open the terminal and type:

ss -tuln

This will display all listening and non-listening connections, just like netstat.

To filter out specific states, for example, established connections:

ss -t state established

ss is known for its speed, as it is able to fetch and display connection information much faster than netstat, especially on busy systems.

3. lsof (List Open Files)

The lsof command is generally used to list all open files and the processes associated with them. It can also be used to display network connections by listing the open sockets and associated connections.

How to Use lsof:

Linux/macOS:

Open the terminal and type:

lsof -i

This command lists all open network connections.

To display only the TCP connections:

lsof -i tcp

While lsof is useful for tracking down network connections associated with specific processes, it may not be as fast or convenient for general connection monitoring compared to netstat or ss.

4. PowerShell (Windows)

On Windows, you can use PowerShell to monitor network connections as well. Although netstat is a simple solution for most users, PowerShell offers advanced options for displaying network activity.

How to Use PowerShell:

Open PowerShell by pressing Win + X and selecting Windows PowerShell.
Type the following command to display active TCP connections:

Get-NetTCPConnection

This will show all active TCP connections and their respective states.

You can also filter results by state:

Get-NetTCPConnection | Where-Object {$_.State -eq 'Established'}

PowerShell provides an advanced approach for more detailed analysis, especially useful in enterprise environments where custom scripts and automation are required.

Why Is Displaying Active Network Connections Important?

Security and Intrusion Detection: Monitoring network connections is a vital aspect of detecting unauthorized access or suspicious activity on your network. Active connections can indicate if malware or an attacker is trying to communicate with your system.
Troubleshooting Network Issues: By examining active connections, administrators can troubleshoot network bottlenecks, misconfigurations, or bandwidth issues. For instance, if an application is consuming an excessive amount of resources, network tools can identify it by showing its associated open ports.
Performance Optimization: Viewing network connections also helps to optimize the system's network performance. By knowing which connections are actively using bandwidth, administrators can make informed decisions about throttling or prioritizing certain connections.