How to view active network connections

If you need to see and know what are the connections that are active on the network or the programs that are accessing the internet, we are going to see some commands that you can use to see the active connections.

This is useful for, for example, knowing if there is some malware that is sending information to a certain hidden place, without your consent (since most of the time they work without being perceived) or proof of the connection of an application.

Using the netstat command

Open a CMD window. Just press the Win key (the key with the symbol for Windows) and the letter R. Type cmd and hit Enter.

Netstat

If you type the command netstat and then press Enter it will appear in a list with the TCP connections and their respective ports that are currently being used. The list appears:

netstat-n

This command displays the same list of TCP connections and ports, but numerical, with IP addresses instead of actual names of computers or services.

netstat-a

Shows all connections and ports.

Netstat-b

To do this command you need to have administrator privileges, that is, simply open the program from the command prompt as administrator. To do this, simply go to the Windows Start menu, find cmd, right-click on the CMD icon and choose the "run as administrator" option.

This command will show you the list of open connections on the ports separated by programs that connect to the network or the internet. In some cases an executable program will have several separate components that connect to different places, shown in the list.

The name of the executable file is enclosed in square brackets as can be seen in the image below with the name of and.

Other netstat commands

We have listed the main netstat commands, but there are others that may be useful to you. To see the other variations of the command with the description of what each one does, just enter: netstat /?

Viewing connections in real time

With netstat we can visualize the connections, ports and protocols used in more “static”, which means that the information is not updated in real time.

There is a program called TCPVIEW that works for him, detailing in a list all the TCP and UD connections on his system, both local and remote. And best of all, this information is updated in real time. So when there is an attempt to access the network, it is shown here.

In green: They are the new communication points made by an application;

In yellow: they are points that have the update status changed;

Red: Connections are removed;