How to Use Netstat Command

* CREATED BY DISRUPTION *
--------------------------

In this tutorial I will be discussing Netstat Commands.

You are probably wondering what Netstat commands are right?
Well Netstat Commands are types of commands that allow the user to see certain things like:

* TCP and UDP Connections
* Connections To The Internet
* Ability to Identify a RAT

To locate a list of all these netstat commands you can visit the following site:
http://commandwindows.com/netstat.htm

Now in this next step, I will show you how to identify a RAT with Netstat.
This will be my canned speech to a user:

Hi (User),
I noticed some suspicious activity in your Running Processes. I would like to gather more information so I am going to need to do a few steps.

Pre-Step:
Please open the following items:
Command Prompts (Start/Run/cmd or Start/Accessories/Command Prompts)
Task Manager ( Right click taskbar;Start Task Manager)

Step1:
In this step we are going to be using a Netstat Command.

Steps of Usage:

* Type "netstat -a" into command prompts
* Leave this open until prompt to close


Step 2: While having Command Prompts Open, Please open Task Manager. Also once open, please click the tab "View" and click "select columns".
Mark the first thing "PID" aka Process Identifier.

Step 3: Now compare each by looking at the PID in Taskmanager and look at the information or Numbers after the local IP Address in Command Prompts and compare them.

In your next post please provide a picture with the TaskManager and Command prompt.


Now as you can see I am comparing to identify the processes match the CMD.

Now if there were certain infections that were connecting to the internet, we could assume it's a rat.

Now next time I will explain some more about Netstat.

-Disruption
-----------------------------------------------------------------------------------

This is quite a helpful tutorial. I've known about this for some time. I also found out that if you do some digging with netstat -n you can get someone's IP if you're on Skype with them.

or on msn if send a file to them

Very nice tutorial mate.

Thanks for the feedback. Some of you are missing the point. This is a simple way to see if your infected and to see if their is a RAT on your computer. Not to infect users and/or obtain their IP Address.

Ubuntu has a GUI for netstating, traceroutes, port scans and pings, silly windows.

Carbon said:

Ubuntu has a GUI for netstating, traceroutes, port scans and pings, silly windows.

Click to expand...

You kind of just busted my bubble with that statement. I am assuming you use Ubuntu.

Disruption said:

You kind of just busted my bubble with that statement. I am assuming you use Ubuntu.

Click to expand...

I run a desktop, and three laptops I use for botting with it.

Just a free little bump for this thread: netstat -ano has a whole different column for PIDs, so it's a bit more noob-friendly.