How to find out all open ports, connections and originating IP addresses

April 3rd, 2008 Ajith Posted in Command Prompt/Shell, Uncategorized 1 Comment »

netstat is a command available in both Windows and Unix to analyze local ports that are open and all the connections to those ports. The syntax of the command is very simple.

Netstat in action showing my IP and Ports

In the picture above a verysimple example of seeing the ports and connections is shown. The -ano option tells a - all connections n - do not attempt to resolve name o - show the process ID.
The advantage of resolving name is that you can identify a LAN or Internet connection server easily.

Displays active TCP connections, ports on which the computer is listening, Ethernet statistics, the IP routing table, IPv4 statistics (for the IP, ICMP, TCP, and UDP protocols), and IPv6 statistics (for the IPv6, ICMPv6, TCP over IPv6, and UDP over IPv6 protocols). Used without parameters, netstat displays active TCP connections.
Syntaxnetstat [-a] [-e] [-n] [-o] [-p Protocol] [-r] [-s] [Interval]
Top of pageTop of page
Parameters

-a : Displays all active TCP connections and the TCP and UDP ports on which the computer is listening.

-e : Displays Ethernet statistics, such as the number of bytes and packets sent and received. This parameter can be combined with -s.

-n : Displays active TCP connections, however, addresses and port numbers are expressed numerically and no attempt is made to determine names.

-o : Displays active TCP connections and includes the process ID (PID) for each connection. You can find the application based on the PID on the Processes tab in Windows Task Manager. This parameter can be combined with -a, -n, and -p.

-p Protocol : Shows connections for the protocol specified by Protocol. In this case, the Protocol can be tcp, udp, tcpv6, or udpv6. If this parameter is used with -s to display statistics by protocol, Protocol can be tcp, udp, icmp, ip, tcpv6, udpv6, icmpv6, or ipv6.

-s : Displays statistics by protocol. By default, statistics are shown for the TCP, UDP, ICMP, and IP protocols. If the IPv6 protocol for Windows XP is installed, statistics are shown for the TCP over IPv6, UDP over IPv6, ICMPv6, and IPv6 protocols. The -p parameter can be used to specify a set of protocols.

-r : Displays the contents of the IP routing table. This is equivalent to the route print command.

Interval : Redisplays the selected information every Interval seconds. Press CTRL+C to stop the redisplay. If this parameter is omitted, netstat prints the selected information only once.

/? : Displays help at the command prompt.

Automatically refreshing the connection details (click to enlarge image in a new window)The second image shows the capability of netstat to auto refresh. the interval given is in seconds. the 2 indicates refresh every 2 seconds. This is used to continuously update the screen with the current connection informations. You can use this option to onitor which all connections are occuring at each time and the status of different connections. To abort from the autorefresh mode you can press CTRL + C and return to the normal Command Prompt

TCP View - netstat with GUI

TCPView from Sysinternals (now a part of microsoft) did a good job by giving a user interface to the netstat command. TCP View by default shows the remote connection name also.

TCPView from Sysinternals a screenshotThe user interface is neat and clutter free and the download is extremely small at only 94Kb. You have the option to enable or disable Name resolving from IP. The update speeds are also configurable. The main advantage is that you are shown the process names responsible for all the connections directly in the UI. netstat could only display the PIDs.With a little experince you can start monitoring for outgoing and incoming traffic and control them easily using these tools. To control a connection there are two basic options provided with TCPView - Kill Process (to kill a process responsible for the connection) and Close connection. Both os the tools also show the status of the signal.

How to download videos as mp4 from youtube site

Buy me a cup of hot coffee - help me keep posting all through the night

AddThis Social Bookmark Button

Hide files under other files (merge) using command prompt

February 6th, 2008 Ajith Posted in Command Prompt/Shell, Tips No Comments »

Here is how you can hide files from the prying eyes of others. This can be done by using the copy command in Command Prompt. The format of the command to merge files is 

copy /b FILE1.ext+FILE2.ext+….+FILEn.EXT destination.EXT

Copy Command in work

The parameter /b tells the command to consider files as Binary. An example is “copy /b 1.jpg+2.zip 3.jpg” which will produce an image named 3.jpg after merging the image 1.jpg and compressed archive 2.zip The file is now treated as an Image of JPEG type. It’s always better to use two files as this will enable you to recover both the files (else you may need a hex editor to split the files).When you want to open the zipped file change the extension of the merged file from .jpg to .zip (if Windows Zip utility won’t open the file use another archive tool such as WinRAR or WinZIP).

The trick can be done with most of the file types. You will not able to recover the second file by changing the extension if both files are of same type, that is both JPG or both ZIP. A HEX editor can be used to find the header of second file, you may copy the data further onwards to a new file to get the lost file.

These are the screen shots of my merging process

The Image file and the Archive before MergingImage and Archive before merging

Files Merged (check out the file sizes of all the three files )
Merged file after The Archive has been locked under the image

The Image file after merging has been renamed to .rar (extension of second file) and has been opened using WinRAR

renamed and opened

If you use a zip file instead, Windows Compressed Folder manager may not recognize the file but a dedicated Archive tool like WinRAR will be able to open the archive.

Buy me a cup of hot coffee - help me keep posting all through the night

AddThis Social Bookmark Button

Batch files to automate tasks in Windows environment - tutorial

January 24th, 2008 Ajith Posted in Command Prompt/Shell, Windows No Comments »

A Batch file is any file with an extension .bat . The batch file is special in the sense that whatever you enter in a batch file, will be run as Commands in Command Prompt one line at a time. The commands will be shown in the prompt as they are run.

Creating and Editing :

Creating and Editing Batch Files in WindowsCreate a batch file named batch.bat in your C:\WINDOWS folder. (take note pad and save the file as Save As batch.bat ). type something like shutdown /? inside the file after opening it in notepad or any other text editor and save the file. Go to Command Prompt START >> All Programs >> Accessories >> Command Prompt and type “batch”. A screen similar to the one shown below will appear. The shutdown /? command will show you a simple help on shutdown command’s options and usage. This is a simple example for using the batch file for automating tasks.

Create and Edit batch file

Working :

When you type “batch” in the command prompt Windows looks for executable files named batch first (.COM and then .EXE) then if both of them are not found Windows searches for a file with name batch and extension bat. So now Windows will have located our batch file. Then every line in the batch file are treated as commands. So we have shutdown /? on the first line. This is executed and the output is shown. The locations where Windows looks for commands are set in the PATH Environment Variable

To prevent showing each command on the command prompt before it is run, just add @echo=OFF to the first line of the batch file.

To create a Batch file Right Click and select NEW»Text Document. Rename it with FILENAME.bat (you must have disabled Hide extensions for known file types in Folder Options ). Now drag it to Notepad and type in the command you want to run, Save it (CTRL+S) and close. Or you can open notepad type the commands and then take File>>Save As and in the name filed give FILENAME.BAT and in the File Type give All Types.

At first you may seem this as non-useful but there are many parameters in command prompt including if, for etc.. which will make this a whole lot useful. I will cover automating the tasks in next part of this tutorial.

Buy me a cup of hot coffee - help me keep posting all through the night

AddThis Social Bookmark Button

Built in parental control in Windows XP - control the time users can login to your computer

December 17th, 2007 Ajith Posted in Command Prompt/Shell, How To, Windows 13 Comments »

One of the talked about feature of Windows Vista was the parental control. In Vista the parental control is in a matured form and is available with lots of functions which were not manageable centrally on any previous versions of Windows.

How to download videos as mp4 from youtube site

One feature is the time login time limit. Parents can actually set the time their children can access the computer for each day and this is shown in a grid view for convenience.

Vista account login time control in grid form a screen shot
But what if you don’t have Vista. You got XP at home :( What do you do ?Well worry not this time limited login is actually available in Windows XP too, but in a more crude form. The option is provided to you through the Command Prompt by net user command. The net services command is one among the most powerful and useful commands available in Windows XP command prompt. It allows an Administrator to do and automate many system administrative task. Let me come to the point :

Syntax :

net user [account name] [Password/*] /times:DAYRANGE,TIME;
replace [account name] with the account you want to control.
[Password] you can insert the password here or put a * instead, in which case you will be asked to type the password (used to hide password)
/times is the option
DAYRANGE put the start and end day codes here
The different days of week are represented as M,T,W,Th,F,Sa,Su
Time can be 12 hour or 24 hour, in case of 12 hour usage of AM/PM mandatory.

An example :

net user command time control example
net user Others ajith /times:Su-Sa,3-15;Sa,9-12;
will restrict a user with account name Others and password ajith from logging in at times other than the specified ones. To clear all restrictions just type :
net user [account name] [Password/*] /times:allJust Play with the command and you can find other uses of net service commands. Now what will happen if the user tries to login during the hours other than specified in the command. Well the user will be given a wrong password error. When I tried to run a program as the restricted user after loging in to Administrator the following error message was shown :

Error when a program is tried to run as restricted account
Here are some more posts you may be interested in : Get your new blog indexed instantly by Google | Use affiliate links without losing your PR | Change default folder from which Windows shows Wallpapers

This is a brief summary about the net user commands on Microsoft Knowledge Base :

Net user

Adds or modifies user accounts or displays user account information.

Syntax

net user [UserName [Password | *] [options]] [/domain]

net user [UserName {Password | *} /add [options] [/domain]]

net user [UserName [/delete] [/domain]]

Parameters

UserName : Specifies the name of the user account to add, delete, modify, or view. The name of the user account can have as many as 20 characters.

Password : Assigns or changes a password for the user’s account. Type an asterisk (*) to produce a prompt for the password. The password is not displayed when you type it at the password prompt.

/domain : Performs the operation on the domain controller in the computer’s primary domain.

options : Specifies a command-line option. The following table lists valid command-line options that you can use.

The article is very long so please goto the link given at the bottom and read.contact me

Microsoft KB : Read about net services command | Full options of net user command

Buy me a cup of hot coffee - help me keep posting all through the night

AddThis Social Bookmark Button

How to shutdown, restart, logoff using the command prompt

March 21st, 2007 Ajith Posted in Command Prompt/Shell No Comments »

You can shutdown restart and do many other similar tasks using the Windows Command Prompt. This will come to use many a times if you are using batch files a lot. And would like to automate some Windows tasks.

Go to Command Prompt (Start»All Programs»Accessories»Command Prompt ). In the command prompt type shutdown /? this brings the Help for shutdown command in windows. Here are the most frequently used ones

1. shutdown /? This displays the help for the shutdown command.
2. shutdown -s this command will SHUTDOWN the system.
3. shutdown -r This command RESTARTs the system.
4. shutdown -a This command aborts (cancel) any shutdown process in progress including those initiated by your system administrator.

This is a quick reference to most frequently used parameters for shutdown command. Here is the original help information on Microsoft© website.

Allows you to shut down or restart a local or remote computer. Used without parameters, shutdown will logoff the current user.
Syntax :
shutdown [{-l|-s|-r|-a}] [-f] [-m [\\ComputerName]] [-t xx] [-c "message"] [-d[u][p]:xx:yy]Parameters
-l : Logs off the current user, this is also the default.
-m : ComputerName takes precedence.
-s : Shuts down the local computer.
-r : Reboots after shutdown.
-a : Aborts shutdown. Ignores other parameters, except -l and ComputerName. You can only use -a during the time-out period.
-f : Forces running applications to close.
-m [\\ComputerName] : Specifies the computer that you want to shut down.
-t xx : Sets the timer for system shutdown in xx seconds. The default is 20 seconds.
-c “message” : Specifies a message to be displayed in the Message area of the System Shutdown window. You can use a maximum of 127 characters. You must enclose the message in quotation marks.
-d [u][p]:xx:yy : Lists the reason code for the shutdown. The following table lists the different values.
Value Description
u - Indicates a user code.
p - Indicates a planned shutdown code.
xx - Specifies the major reason code (0-255).
yy - Specifies the minor reason code (0-65536).

If you have some doubts about command prompt feel free to post a comment or contact me

Buy me a cup of hot coffee - help me keep posting all through the night

AddThis Social Bookmark Button




My Google  Netvibes  My Yahoo!  Windows Live  Bloglines  Newsgator