Make good use of netstat command avatar Win7 security master

Some basic commands can often play a big role in protecting network security. The functions of the following commands are very prominent.

Detecting network connections

If you suspect that someone has installed a Trojan on your computer, or if you have a virus, but there is no perfect tool to detect if this is the case. , you can use the Windows network command to see who is connecting to your computer. The specific command format is: netstat -an This command can see all the ips that establish a connection with the local computer. It contains four parts - PRoto (connection mode), local address (local connection address), foreign address (and local establishment). The address of the connection), state (current port state). With the details of this command, we can fully monitor the connection on the computer to achieve the purpose of controlling the computer.

We enter the following at the command prompt: netstat -a shows all ports currently open on your computer, netstat -s -e shows your network data in more detail, including TCP, UDP, ICMP And IP statistics and so on, you may have seen it. Have you ever thought about the knowledge of Vista, Windows 7 display protocol statistics and current TCP/IP network connections?

The netstat command is used as follows (hint: it is in the order of a-b) -

NETSTAT: Vista/Windows7 shows protocol statistics and current TCP/IP network connections. You can run netstat directly without parameters, as shown in the figure:

NETSTAT [-a] [-b] [-e] [-f] [-n] [-o] [-p proto] [-r ] [-s] [-t] [interval]

-a Show all connections and listening ports.

-b Displays the executables involved in creating each connection or listening port. In some cases, it is known that an executable program hosts multiple independent components, in which case

is the sequence of components involved in creating a connection or listening on a port. In this case, the name of the executable is at the bottom [], and the component it calls is at the top until it reaches TCP/IP. Note that this

item can be time consuming and can fail if you don't have sufficient permissions.

-e Displays Ethernet statistics. This option can be combined with the -s option.

-f Displays the fully qualified domain name (FQDN) of the external address.

-n Displays the address and port number in numeric form.

-o Shows the process IDs associated with each connection.

-p proto Displays the connection of the protocol specified by proto; proto can be any of the following: TCP, UDP, TCPv6 or UDPv6. If used with the -s option to display statistics for each protocol, proto can be any of the following: IP, IPv6, ICMP, ICMPv6, TCP, TCPv6, UDP, or UDPv6.

-r Displays the routing table.

-s Displays statistics for each protocol. By default, statistics for IP, IPv6, ICMP, ICMPv6, TCP, TCPv6, UDP, and UDPv6 are displayed; the -p option can be used to specify a subnet that is recognized by the

.

-t Displays the current connection uninstall status.

interval Redisplays the selected statistics, the number of seconds between pauses between displays. Press CTRL+C to stop redisplaying statistics.

Disabling unidentified services

A lot of friends will find that the computer slows down after a system restarts one day. This time it is likely that someone else has opened up a special one after invading your computer. Some kind of service, such as IIS information service. You can use "net start" to check what services are open in the system. If you find a service that is not open to you, we can disable the service in a targeted manner. The method is to directly enter "net start" to view the service, and then use "net stop server" to disable the service.

Easy to check accounts

For a long time, malicious attackers like to use a clone account to control your computer. The method they use is to activate the default account in a system, but this account is not used often, and then use the tool to promote this account to administrator privileges. On the surface, this account is still the same as the original, but this clone The account is the biggest security risk in the system. A malicious attacker can control your computer arbitrarily through this account. To avoid this, you can test your account in a very simple way.

First enter the net user in the command line, check what users on the computer, and then use "net user + user name" to see what permissions this user belongs to, generally except the Administrator is the administrators group, others No! If you find that a system built-in user belongs to the administrators group, it is almost certain that you have been compromised, and someone else has cloned the account on your computer. Use "net user username /del" to delete this user!