U drugom članku objasnili smo računalne portove i za što se koriste^{(explained computer ports and what they’re used for)} . Osim toga, što možemo učiniti s informacijama o portu? Budući da sav promet na računalu i iz njega ide kroz portove, možemo ih provjeriti da vidimo što rade. Možda luka ne osluškuje promet? Možda nešto koristi port koji ne bi trebao biti? 

Koristit ćemo Windows naredbu netstat da vidimo naše portove za slušanje i PID ( ID procesa^{(Process ID)} ). Također ćemo vidjeti što možemo učiniti s tim informacijama.

Što je Netstat?^{(What Is Netstat?)}

Naredba netstat kombinacija je riječi 'network' i 'statistics'. Naredba netstat radi u svim verzijama sustava Windows od Windows XP do Windows 10 . Također se koristi u drugim operativnim sustavima (OS) kao što su Unix i Linux , ali ovdje ćemo se zadržati na Windowsima^(Windows) .

Netstat nam može pružiti:

• Naziv protokola koji port koristi ( TCP ili UDP ).
• Lokalna IP adresa i naziv računala i broj porta koji se koristi.
• IP adresa i broj porta na koji se povezujemo.
• Stanje TCP veze. Za detalje o tome koja su to stanja, pročitajte odjeljak Obrada događaja u RFC 793^{(Event Processing section of RFC 793)} .

Korištenje Netstata za pregled portova za slušanje i PID-a^{(Using Netstat To See Listening Ports & PID)}

• Koristite kombinaciju tipki Win Key + Win Key + XU izborniku koji se otvori odaberite Naredbeni redak^{(Command Prompt)} .

• Unesite^(Enter) naredbu

  netstat -a -n -o

  . Parametrima za netstat prethodi crtica, a ne kosa crta kao mnoge druge naredbe. -a mu govori da nam pokaže sve aktivne veze i portove na kojima računalo sluša.
  
  -n govori netstatu da prikaže IP adrese i portove samo kao brojeve. Poručujemo mu da ne pokušava razriješiti imena. To omogućuje brži i uredniji prikaz. -o govori netstatu da uključi PID . Kasnije ćemo koristiti PID kako bismo saznali koji proces koristi određeni priključak.

• Pogledajte^(View) rezultate i zabilježite adrese, brojeve portova, stanje i PID . Recimo da želimo znati što koristi port 63240. Imajte na umu da je njegov PID 8552 i da se povezuje na IP adresu 172.217.12.138 na portu 443.

Što koristi taj port?^{(What’s Using That Port?)}

• Otvorite Upravitelj zadataka^{(Task Manager)} . To je najlakše učiniti kombinacijom Ctrl + Shift + Esc .

• Kliknite na karticu Detalji^{(Details )} . Da biste ovo lakše pronašli, kliknite na zaglavlje stupca PID da biste brojčano sortirali PID -ove.^(PIDs)

• Pomaknite se prema dolje do PID 8552 i pogledajte o kojem se procesu radi. U ovom slučaju, to je googledrivesync.exe . Ali je li stvarno? Ponekad virusi mogu izgledati kao legitimni procesi.

• U web-pregledniku idite na ipinfo.io . Unesite IP adresu 172.217.12.138 . Kao što vidimo, IP adresa je registrirana na Google . Dakle, ovaj googledrivesync.exe je legitiman.

Kako dobiti port, PID i naziv procesa u PowerShell-u^{(How To Get Port, PID, & Process Name In PowerShell)}

PowerShell je Microsoftov noviji način korištenja sučelja naredbenog retka sa sustavom Windows^(Windows) . Mi kažemo noviji, ali postoji već nekoliko verzija. Trebali biste naučiti PowerShell čak i ako ste kućni korisnik^{(learn PowerShell even if you’re a home user)} .

Većina Windows naredbi također radi u PowerShell -u , plus možemo ih kombinirati s PowerShell cmdletima – izgovorenim command-lets . Joe na Winteltools.com daje skriptu za ovu metodu.

• Otvorite Notepad i unesite sljedeći kod:

$netstat = netstat -aon | Select-String -pattern "(TCP|UDP)"
$processList = Get-Process

foreach ($result in $netstat) {
   $splitArray = $result -split " "
   $procID = $splitArray[$splitArray.length – 1]
   $processName = $processList | Where-Object {$_.id -eq $procID} |    select processname
   $splitArray[$splitArray.length – 1] = $procID + " " +      $processName.processname
   $splitArray -join " "
}

• Spremite datoteku kao get-NetstatProcessName.ps1 . Obavezno zabilježite gdje se sprema. Važno je promijeniti tip Spremi kao:^{(Save as type: )} u All Files (*.*) ili će se spremiti kao get-NetstatProcessName.ps1 .txt i neće raditi za nas.

• Otvorite PowerShell i idite do mjesta na kojem je skripta spremljena. U ovom slučaju, to su <pre>cd C:Scripts</pre>. Pritisnite Enter za pokretanje naredbe.

• Pokrenite skriptu koristeći dot-sourcing da bi radila. To znači koristiti ./ ispred naziva datoteke. Naredba će biti

  ./get-NetstatProcessName.ps1< /pre > 

• Sada možemo vidjeti sve tradicionalne netstat informacije plus naziv procesa. Više ne morate otvarati Task Manager .

Idi po njih^{(Go Get Them)}

Pokrili smo dva načina korištenja naredbe netstat za pregled portova za slušanje. Može se koristiti ili u starom naredbenom retku^{(Command Prompt)} ili unutar PowerShell skripte. Uz informacije koje nam može dati, pogledali smo kako nam mogu pomoći da shvatimo što naše računalo radi. 

Ako ste mislili da je netstat izvrstan uslužni program, pogledajte neke druge Windows TCP/IP uslužne programe kao što su tracert, ipconfig i nslookup . Ili upotrijebite Resource Monitor da biste bolje pogledali skrivene web stranice i internetske veze^{(use Resource Monitor to get a better look into hidden website and Internet connections)} . Mnogo toga možete učiniti kako biste točno vidjeli što vaše računalo radi.

Jeste li koristili netstat za rješavanje problema? Recite^(Please) nam što ste učinili. Imate li pitanja o tome kako koristiti netstat? Pitajte^(Please) nas u komentarima ispod.

Use Netstat to See Listening Ports and PID in Windows

In another article, we explained computer ports and what they’re used for. Other than that, what can we do with port information? Since all traffic in and out of the computer goes through ports, we can check on them to see what they’re doing. Maybe the port isn’t listening for traffic? Maybe something is using a port that shouldn’t be? 

We’re going to use the Windows command netstat to see our listening ports and PID (Process ID). We’re also going to see what we can do with that information.

What Is Netstat?

The netstat command is a combination of the words ‘network’ and ‘statistics’. The netstat command works in all versions of Windows from Windows XP right up to Windows 10. It’s also used in other operating systems (OS) like Unix and Linux, but we’ll stick to Windows here.

Netstat can provide us with:

• The name of the protocol the port is using (TCP or UDP).
• The local IP address and name of the computer and the port number being used.
• The IP address and port number to which we’re connecting.
• The state of a TCP connection. For details on what these states are, read the Event Processing section of RFC 793.

Using Netstat To See Listening Ports & PID

• Use the key combination Win Key + X. In the menu that opens, select Command Prompt.

• Enter the command <pre>netstat -a -n -o</pre>. The parameters for netstat are preceded with a hyphen, not a forward slash like many other commands. The -a tells it to show us all active connections and the ports on which the computer is listening.
  
  The -n tells netstat to show the IP addresses and ports as numbers only. We’re telling it to not try to resolve the names. This makes for a quicker and neater display. The -o tells netstat to include the PID. We’ll use the PID later to find out what process is using a specific port.

• View the results and take note of the addresses, port numbers, state, and PID. Let’s say we want to know what’s using port 63240. Note that its PID is 8552 and it’s connecting to the IP address 172.217.12.138 on port 443.

What’s Using That Port?

• Open Task Manager. That’s most easily done by using the key combination Ctrl + Shift + Esc.

• Click on the Details tab. To make this easier to find, click on the PID column header to sort the PIDs numerically.

• Scroll down to PID 8552 and see what process it is. In this case, it’s googledrivesync.exe. But is it really? Sometimes viruses can make themselves look like legitimate processes.

• In a web browser, go to ipinfo.io. Enter the IP address 172.217.12.138. As we can see, the IP address is registered to Google. So this googledrivesync.exe is a legitimate one.

How To Get Port, PID, & Process Name In PowerShell

PowerShell is Microsoft’s newer way to use a command-line interface with Windows. We say newer, but it’s been around for several versions. You should learn PowerShell even if you’re a home user.

Most Windows commands also work in PowerShell, plus we can combine them with PowerShell’s cmdlets – pronounced command-lets. Joe at Winteltools.com provides the script for this method.

• Open Notepad and enter the following code:

$netstat = netstat -aon | Select-String -pattern "(TCP|UDP)"
$processList = Get-Process

foreach ($result in $netstat) {
   $splitArray = $result -split " "
   $procID = $splitArray[$splitArray.length – 1]
   $processName = $processList | Where-Object {$_.id -eq $procID} |    select processname
   $splitArray[$splitArray.length – 1] = $procID + " " +      $processName.processname
   $splitArray -join " "
}

• Save the file as get-NetstatProcessName.ps1. Make sure to note where it’s being saved. It’s important to change the Save as type: to All Files (*.*) or it will get saved as get-NetstatProcessName.ps1.txt and it won’t work for us.

• Open PowerShell and navigate to the location in which the script was saved. In this case, it’s <pre>cd C:\Scripts</pre>. Hit Enter to run the command.

• Run the script using dot-sourcing to make it work. That means use ./ before the name of the file. The command will be <pre>./get-NetstatProcessName.ps1</pre> 

• Now we can see all the traditional netstat info plus the process name. No need to open Task Manager anymore.

Go Get Them

We’ve covered two ways to use the netstat command to see listening ports. It can be used either in the old Command Prompt or within a PowerShell script. With the information it can give us, we’ve looked at how it can help us figure out what our computer is doing. 

If you thought netstat is a great utility, take a look at some other Windows TCP/IP utilities like tracert, ipconfig, and nslookup. Or use Resource Monitor to get a better look into hidden website and Internet connections. There is a lot you can do to see exactly what your computer is doing.

Have you used netstat to solve a problem? Please tell us what you did. Any questions about how to use netstat? Please ask us in the comments below.

Related posts

• Kako postaviti i koristiti Sandbox preglednika u sustavu Windows

• Upotrijebite Monitor pouzdanosti za provjeru stabilnosti sustava Windows

• Koristite alternativne DNS poslužitelje u sustavu Windows za brži internet

• Koristite male ikone na programskoj traci i radnoj površini sustava Windows 7/8/10

• Kako stvoriti i koristiti Windows 10/11 prečac za način mirovanja

• Spremite popis pokrenutih procesa u tekstualnu datoteku u sustavu Windows

• Kako deinstalirati BlueStacks na Windows i Mac

• Kako omogućiti i koristiti način rada za razvojne programere na Discordu

• Kako se pokrenuti u sigurnom načinu rada u svim verzijama sustava Windows

• Omogućite mikrofon, linijski ulaz i stereo miks u sustavu Windows

• Kako postaviti automatski sustav sigurnosne kopije za Windows

• Izvoz, brisanje i povećanje veličine zapisnika događaja u sustavu Windows

• Pronađite lozinku za WiFi u sustavu Windows 10 pomoću CMD-a

• Kako otvoriti 7Z datoteke u sustavima Windows, Mac i Linux

• Kako pikselirati sliku na Windowsima i Macu

• Dodijelite slova pogona mapama u sustavu Windows

• Kako promijeniti slovo diska u sustavu Windows

• Kako ukloniti zvuk iz videa na Windowsima i Macu

• Kako blokirati udaljene veze na Windows ili Mac računalo

• Kako riješiti problem "Naziv datoteke je predug" u sustavu Windows