netstat

netstat displays active connections, listening sockets, and protocol statistics on both Windows and Linux — the first command to reach for when answering “what is this host talking to?” The two implementations share a name and a few flags but diverge on everything interesting, so the option letter you memorized on one OS is not safe on the other.

Flag comparison

Linux	Windows	Effect
-a	-a	All sockets — listening and established
-i		Per-interface statistics
-l		Listening sockets only
-n	-n	Numeric output — skip DNS/port-name resolution (much faster, no lookup noise)
-p	-o + -b	Owning process: Linux -p shows PID/program (needs root); Windows -o shows PID, -b shows the executable (needs elevation)
-s	-s	Per-protocol statistics
-t	-p TCP	TCP only
-u	-p UDP	UDP only
-x		UNIX domain sockets only

The Windows split of process attribution into two flags trips people up: -o gives you the PID column, -b resolves the owning binary name (and walks the components that loaded it) but requires an elevated prompt and is slow. Combine them — -ano then resolve PIDs, or -abno when you need names in one pass.

Practical recipes

Map a suspicious PID to its listeners (Windows, no admin needed for -ano):

netstat -ano | findstr "LISTENING" | findstr "<PID>"

The reverse — who owns the port — then goes through tasklist /FI "PID eq <PID>" or Get-Process -Id <PID>.

Operational notes

• Recon value: on a fresh foothold, netstat -ano reveals adjacent infrastructure (established RDP/SMB/WinRM sessions tell you who administers this box and from where) and locally-bound services invisible from the network (127.0.0.1 listeners) — complement to powershell-port-scanning, which enumerates other hosts.
• Defense value: baselining listeners per host catches persistence mechanisms that open ports; unexpected ESTABLISHED connections to rare egress IPs are C2-shaped.
• Prefer -n during triage: name resolution stalls output and leaks your interest to DNS logs.
• PowerShell-native successor on modern Windows: Get-NetTCPConnection (per-connection owning PID without elevation quirks), but netstat is universal and works everywhere including down-level hosts.

Sources

• netstat — Microsoft Windows Commands reference

Related

• ss — the faster iproute2 successor on Linux
• powershell-port-scanning — active discovery of open ports on remote hosts
• netsh-windows-firewall — the other built-in network triage tool: which of these listeners the firewall actually exposes
• wmi-remote-service-execution — verifying the result of a remote service start