Diagnose Windows networking with netstat and route
On a canned Windows 11 practice box, use netstat -ano to read active connections, listening ports, UDP endpoints, states, and PIDs; use route print to identify the IPv4 default gateway and local sending interface; then use netstat -b from an elevated prompt to associate connections with executable names. All values are representative samples, and these read-only commands do not inspect or change the learner's machine. Practice, not exam questions. Not a score predictor. Nothing taken from any exam.
Steps
- 1
Run netstat -ano. Read the Proto, Local Address, Foreign Address, State, and PID columns; distinguish TCP ESTABLISHED, LISTENING, and TIME_WAIT rows from UDP rows, which have no State value.
- 2
Run route print. In IPv4 Active Routes, find destination 0.0.0.0 with netmask 0.0.0.0, then read its Gateway as the next hop and its Interface as the local sending address. Note the separate 127.0.0.0 loopback route.
- 3
Run netstat -b from the elevated prompt. Read each bracketed executable or service chain under its connection row, and record Can not obtain ownership information as an unresolved result rather than a security verdict.
What you should see
netstat -ano prints the real Proto, Local Address, Foreign Address, State, and PID shape with TCP and UDP rows. route print shows the Interface List, IPv4 Active Routes with a 0.0.0.0/0 default route and 127.0.0.0 loopback route, Persistent Routes, and the IPv6 table. netstat -b prints connection rows followed by entries such as [chrome.exe], a service name above [svchost.exe], [System], or Can not obtain ownership information.