GCIH · Question #608
What advantage does running netstat with the flags '-nao' have over running netstat with the '-na' flags in Windows?
The correct answer is B. The "-o" flag shows the process ID (PID). The -o flag in Windows netstat appends the owning process ID (PID) to each connection entry, enabling analysts to map network connections to specific running processes.
Question
What advantage does running netstat with the flags '-nao' have over running netstat with the '-na' flags in Windows?
Options
- AThe "-o" flag shows the socket state
- BThe "-o" flag shows the process ID (PID)
- CThe "-o" flag shows UDP connections only
- DThe "-o" flag shows the user ID (UID) of the owner of the socket
How the community answered
(44 responses)- A5% (2)
- B93% (41)
- C2% (1)
Why each option
The -o flag in Windows netstat appends the owning process ID (PID) to each connection entry, enabling analysts to map network connections to specific running processes.
Socket state (e.g., ESTABLISHED, TIME_WAIT) is already displayed by default in netstat output without the -o flag.
In Windows, 'netstat -o' displays the PID for each TCP and UDP connection, allowing defenders and forensic analysts to correlate suspicious network activity to a specific process by cross-referencing the PID with Task Manager or 'tasklist'. This capability is absent with only '-na' flags, making '-nao' significantly more useful for incident response.
Filtering for UDP-only connections is not a function of -o; on Unix-like systems -u is used for UDP, while on Windows netstat already shows UDP when using -a.
Displaying the UID of the socket owner is a Linux/Unix netstat feature (using --program or -p); Windows netstat -o shows PID, not UID.
Concept tested: Windows netstat -o flag for process ID mapping
Source: https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/netstat
Topics
Community Discussion
No community discussion yet for this question.