What exactly does this netstat output mean?

1

Having run netstat /b on my local machine, I am having trouble interpreting this output. To my knowledge I have only one machine on my network and it's not called fish.

Active Connections

  Proto  Local Address          Foreign Address        State
  TCP    127.0.0.1:1032         fish:1033              ESTABLISHED
 [Samsung Link.exe]
  TCP    127.0.0.1:1033         fish:1032              ESTABLISHED
 [Samsung Link.exe]
  TCP    127.0.0.1:1034         fish:1035              ESTABLISHED
 [Samsung Link.exe]
  TCP    127.0.0.1:1035         fish:activesync        ESTABLISHED
 [Samsung Link.exe]
  TCP    127.0.0.1:1036         fish:1037              ESTABLISHED
 [Samsung Link.exe]
  TCP    127.0.0.1:1037         fish:1036              ESTABLISHED
 [Samsung Link.exe]
  TCP    127.0.0.1:1038         fish:1039              ESTABLISHED
 [Samsung Link.exe]
  TCP    127.0.0.1:1039         fish:1038              ESTABLISHED
 [Samsung Link.exe]
  TCP    127.0.0.1:7439         fish:7440              ESTABLISHED
 [firefox.exe]
  TCP    127.0.0.1:7440         fish:7439              ESTABLISHED
 [firefox.exe]

Tom

Posted 2015-04-08T22:48:42.913

Reputation: 143

3What about a phone or Smart TV? You could try netstat /b /n to get the IP of the foreign machine. – heavyd – 2015-04-08T23:19:37.270

This reveals that it does refer to my computer, it shows 127.0.0.1: client and server are on the same machine. Weird thing is when I check my computer name in 'This PC>Properties>Computer Name', it's not fish. So where does this come from I wonder. – Tom – 2015-04-09T04:09:45.943

Answers

3

When you run netstat -b:

Displays the executable involved in creating each connection or listening port. In some cases well-known executables host multiple independent components, and in these cases the sequence of components involved in creating the connection or listening port is displayed. In this case the executable name is in [] at the bottom, on top is the component it called, and so forth until TCP/IP was reached. Note that this option can be time-consuming and will fail unless you have sufficient permissions.

Under "Foreign Address," fish is your Computer Name. You can verify this by pressing
enter image description here + x and then pressing y, which will bring up "System" in Windows. Here you can verify the name of your computer.

The executable involved in creating each one of your connections is Samsung Link.exe, which is a program that allows you to share information between devices on your network. As you can see, all the connections are coming from your computer; why so many TCP connections, I do not know (but I'd like to know!)

To learn more about Samsung Link.exe, click here.

I hope this helps, and thank you for reading my answer!

cody.codes

Posted 2015-04-08T22:48:42.913

Reputation: 1 172

2

I agree; the OP’s computer must think that its name is “fish”.  (1) Note that the local ends of the connections are all 127.0.0.1, which is the localhost/loopback address.  No external host can connect to that, only processes on the same machine.  (2) Also note that the connections occur in pairs: 1032 is connected to 1033, and then 1033 is connected to 1032, with the same process.  See Is the same port acting as both client and server?

– Scott – 2015-04-09T03:00:07.283

Thanks Scott, yes you are right, however my computer name in 'This PC>Properties>Computer Name', is not fish, which I guess is the root of my confusion. – Tom – 2015-04-09T04:11:50.567

I'll be on the lookout for anything that looks fishy. – cody.codes – 2015-04-09T04:16:09.723

Asked: 2015-04-08T22:48:42.913

Viewed: 1 386 times

Active: 2015-04-09T02:44:40.633