print

Tip of the Month

June 2000

The "netstat" command

One of the handiest troubleshooting tools when focusing on a particular workstation or server problem may be right at your fingertips!

Unix, Linux, and Windows operating systems come with the nifty little "netstat" command. There are several options for you to explore, but the "netstat -s" option comes in handy for diagnosing TCP/IP related problems.

For IP, you can see how many packets were received and if any were discarded. You also get a list of ICMP error messages that will tell you, for instance, how many "destination unreachable" packets were returned to the workstation (or server for that matter).

For UDP, you get a count of the number of sent and received UDP datagrams and how many datagrams were received for an unknown port.

For TCP, you can see how many segments were sent and received, how many of those had to be resent (transport retransmissions), a count of failed connection attempts, and how many resets were sent.

This is very valuable information. Some implementations of netstat have even more statistics then the examples listed above.

By watching these statistics periodically during a troubleshooting session with a user or server, you can use a protocol analyzer at the same time to get more details about transport retransmissions, unreachable IP addresses, port numbers that other users/applications are maliciously or erroneously trying to get to, etc.