Endpoint Security Concepts · Topic 2 of 6

The netstat, nslookup and tcpdump Tools

Learn what netstat, nslookup and tcpdump show, how to read their output on an endpoint, and how each helps you spot suspicious connections and traffic.

4 min

In a nutshell

netstat shows connections and listening ports on the local computer.
netstat -an shows all connections with numeric addresses.
LISTENING means waiting for connections, and ESTABLISHED means an active connection.

What it is

These three command line tools show what an endpoint is doing on the network.

netstat lists the connections and listening ports on the computer. nslookup asks a DNS server to turn names into addresses. tcpdump captures and displays the packets themselves.

They are used to gather facts when something looks wrong, such as an unknown connection or a strange name lookup.

How it works

Each tool answers a different question, so you often use them one after another.

netstat

netstat shows network statistics for the local computer. It lists active connections, the ports where the computer is listening, and the state of each connection.

C:\> netstat -an
Proto  Local Address        Foreign Address      State
TCP    0.0.0.0:445          0.0.0.0:0            LISTENING
TCP    192.168.1.20:50312   203.0.113.9:443      ESTABLISHED

Useful options on Windows include:

Option	What it does
`-a`	Shows all connections and listening ports
`-n`	Shows addresses and port numbers as numbers, without name lookups
`-o`	Adds the process ID that owns each connection
`-b`	Shows the program behind each connection, and needs administrator rights

Common states to know:

LISTENING means a program is waiting for incoming connections on that port.
ESTABLISHED means a connection is open and active.
TIME_WAIT means a connection recently closed and is waiting before it is fully cleared.

Why it matters for security: a port that is listening when it should not be, or an established connection to an address you do not recognise, can point to malware. You then use the process ID to find which program owns it. On many newer Linux systems the ss command does a similar job, and netstat may not be installed.

nslookup

nslookup queries DNS. It shows which IP address a name points to, or which name belongs to an address.

C:\> nslookup example.com
Server:  dns.local
Address: 192.168.1.1

Name:    example.com
Address: 203.0.113.50

The first part shows which DNS server answered. The second part shows the answer. You can also check a specific record type.

C:\> nslookup -type=MX example.com

For security work, nslookup helps you check where a suspicious domain points, compare answers from different DNS servers, and spot a name that resolves to an unexpected address, which can suggest DNS tampering.

tcpdump

tcpdump is a packet capture tool for Linux and macOS. It reads packets from a network interface and prints a summary of each one.

$ sudo tcpdump -i eth0 -n port 53
$ sudo tcpdump -i eth0 -w capture.pcap
$ tcpdump -r capture.pcap

The options used above are:

Option	What it does
`-i eth0`	Chooses the interface to listen on
`-n`	Does not turn addresses and ports into names
`-w FILE`	Writes the raw capture to a file
`-r FILE`	Reads packets back from a saved file
`port 53`	A filter that only shows traffic on port 53

Filters keep the output small. You can filter on a host, a port or a protocol.

A saved capture file can be opened later in a graphical analyser such as Wireshark. Capturing packets needs administrator rights, and it can expose private data, so you should only capture where you have permission.

What to remember for the exam

Seven facts cover most questions on this topic.

netstat shows connections and listening ports on the local computer.
netstat -an shows all connections with numeric addresses.
LISTENING means waiting for connections, and ESTABLISHED means an active connection.
nslookup queries DNS for the address of a name.
tcpdump captures packets from an interface.
tcpdump -w saves a capture file, and -r reads one.
Captures need administrator rights and permission to monitor.

Exam tip

Match the tool to the question. Which connections are open is netstat, what does this name resolve to is nslookup, and what is in the packets is tcpdump.

Common mistakes

These four errors are common.

Reading LISTENING as a connection. A listening port is only waiting. No remote device is connected until the state shows ESTABLISHED.

Using nslookup to test whether a host is up. It tests DNS only, not whether the host answers.

Forgetting the interface in tcpdump. Without the right interface you may capture nothing useful.

Capturing without permission. Packet captures can include passwords and private messages.

Watch out

Only run packet captures on networks and devices you are allowed to monitor. Captures can contain sensitive data.

Check yourself

Work through these three questions.

What does the state LISTENING mean in netstat output?
A program is waiting for incoming connections on that port, and no remote device is connected yet.
Which tool would you use to find the IP address that a suspicious domain name points to?
nslookup, which asks a DNS server to resolve the name.
What do the -w and -r options do in tcpdump?
-w writes the captured packets to a file, and -r reads packets back from a saved file.

Topic 2 of 6 in Endpoint Security Concepts

Test yourself on Endpoint Security Concepts

The full Cisco CCST 100-160 Cybersecurity question bank has 864 questions, with timed practice exams and an explanation for every answer.

Subscribe Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.