Feb 23, 2011

~~Netstat and Ping Command~~DEtailEd with pictures




In this article i will introduce the basic commands that will be used in our further articles about network hacking..So lets start on

1-NETSTAT-It displays protocol statistics and current TCP/IP network connections. i.e. local address, remote address, port number, etc.
 netstat [-a] [-b] [-e] [-f] [-n] [-o] [-r] [-s] [-t] [-v] [-p proto] [interval]

These are the commands 

now their uses

-a Displays all connections and listening ports
-b Displays the executable involved in creating each connection or listening port. (Added in XP SP2.)
-e Displays Ethernet statistics
-f Displays Fully Qualified Domain Names for foreign addresses. (In Windows Vista/7 only)
-n Displays addresses and port numbers in numerical form
-o Displays the owning process ID associated with each connection
-p proto Shows connections for the protocol specified by proto; proto may be any of: TCP, UDP, TCPv6, or UDPv6.
-r Displays the routing table
-s Displays per-protocol statistics
-t Displays the current connection offload state, (Windows Vista/7)
-v When used in conjunction with -b, will display sequence of components involved in creating the connection or listening port for all executables. (Windows XP SP2, SP3)
[interval] An integer used to display results multiple times with specified number of seconds between displays. Continues until stopped by command ctrl+c. Default setting is to display once,

Example command -a

The TCP/IP Connections

TCP and UDP connections and their IP and port addresses can be seen by the command 
  netstat -an
 

 COnfuSed???

ok now the state is what the condition of the TCP or UDP connections


CLOSED Indicates that the server has received an ACK signal from the client and the connection is closed
CLOSE_WAIT Indicates that the server has received the first FIN signal from the client and the connection is in the process of being closed
ESTABLISHED Indicates that the server received the SYN signal from the client and the session is established
FIN_WAIT_1 Indicates that the connection is still active but not currently being used
FIN_WAIT_2 Indicates that the client just received acknowledgment of the first FIN signal from the server
LISTENING Indicates that the server is ready to accept a connection
LAST_ACK Indicates that the server is in the process of sending its own FIN signal
SYN_RECEIVED Indicates that the server just received a SYN signal from the client
SYN_SEND Indicates that this particular connection is open and active

CHECKING FOR MALWARES

Bull shit you got a malware in your computer and cannot find it../?

We can check malwares by the netstat command we need to only see which connections are in a relationship with the outer world

netstat -b 
 Note that the Process ID (PID) is given when using Windows XP. In Windows Vista/7, the switch "o' has to be added to display PIDs. This command can be combined with other tools such as Task Manager to analyze what executable files and processes are active and are trying to make Internet connections.

 Another good news for all you can use this software as an alternate


  password- saurav
___________________________________________________________________
2-PING-Ping is a part of the ICMP (Internet Control Message Protocol) which is used to troubleshoot TCP/IP networks..Ping is used to check weather the host is alive

Our command is
ping hostname.com
 ping is a very use full command for a hacker to obtain ip and check if the host is alive...so remember it

Happy hacking


0 comments:

Post a Comment

Share

Twitter Delicious Facebook Digg Stumbleupon Favorites More