An administrator suspects malware has infected a server. Which of the following should be used to check services communicating with external servers?

The netstat command (network statistics) is a command-line utility that displays active network connections, listening ports, and routing tables. It can reveal which processes or services are establishing outbound connections to external IP addresses, which is crucial for identifying potential command-and-control communication from malware.

arp (Address Resolution Protocol) displays and modifies the IP-to-MAC address translation tables, which is not directly used for checking outbound service communication.

nslookup (name server lookup) is a command-line tool for querying DNS servers to obtain domain name or IP address mapping or for any other specific DNS record, not for active connections.

dig (domain information groper) is a flexible command-line tool for interrogating DNS name servers, similar to nslookup, but not for showing active network connections.