Netstat: Which netstat option lists all active TCP and UDP connections along with their process IDs and listening ports?

Enhance your knowledge as a Computer Hacking Forensic Investigator with the CHFI v11 Test. Use flashcards and multiple-choice questions, complete with hints and detailed explanations, to prepare effectively and ace your exam!

Multiple Choice

Netstat: Which netstat option lists all active TCP and UDP connections along with their process IDs and listening ports?

Explanation:
The key idea is to display every active network connection along with the exact port numbers and the owning process for each connection. Using the set of flags -a, -n, and -o accomplishes this in one command: - -a ensures both established connections and listening ports are shown. - -n prevents name resolution, so you get raw numeric IPs and port numbers, which is clearer and faster for quick analysis. - -o adds the process ID for each connection, so you can see which process owns the socket. Together, these flags produce a complete list of all active TCP and UDP connections with their listening ports and the corresponding process IDs, exactly what the question asks for. Other options serve different purposes—b shows binaries with connections but isn’t the same complete view focused on PIDs; r shows routing information; s shows protocol statistics—so they don’t fit the requirement as well.

The key idea is to display every active network connection along with the exact port numbers and the owning process for each connection. Using the set of flags -a, -n, and -o accomplishes this in one command:

  • -a ensures both established connections and listening ports are shown.
  • -n prevents name resolution, so you get raw numeric IPs and port numbers, which is clearer and faster for quick analysis.

  • -o adds the process ID for each connection, so you can see which process owns the socket.

Together, these flags produce a complete list of all active TCP and UDP connections with their listening ports and the corresponding process IDs, exactly what the question asks for. Other options serve different purposes—b shows binaries with connections but isn’t the same complete view focused on PIDs; r shows routing information; s shows protocol statistics—so they don’t fit the requirement as well.

Subscribe

Get the latest from Examzify

You can unsubscribe at any time. Read our privacy policy