NETSTAT vs. NBTSTAT Differences

Windows is an operating system with many utilities and tools. You probably came across a few of these tools. Namely, the Netstat and Nbtstat utilities. So, are you wondering how they compare?

Netstat is short for network statistics. It shows you what programs are open on what ports over what protocol. Nbtstat allows you to query other machines on your network using NetBIOS over TCP/IP. The Netstat utility is available on different operating systems in various command lines.

What is Netstat? What is Nbtstat? In this article, you’ll discover the differences between Netstat and Nbtstat. You’ll also learn some cool commands to test these tools for yourself.

What’s Netstat?

In networking, Netstat (network statistics) is a command that’s available to you regardless of your operating system.

While the command lines may differ from an operating system, they essentially provide the same statistics.

Why use Netstat? You can use Netstat commands to troubleshoot network problems. You can also use them to find out what services are running on your computer or server.

Because Netstat parameters aren’t universal, you may want to search online for the particular command line to do what you want to achieve.

Here are some command lines you can use on Windows machines to get a taste of what Netstat is all about.

netstat -a

A command that will show all active connections coming into your computer.

netstat -b

A command that’ll show you the programs using those connections. Furthermore, “netstat -b” will show what ports the programs are using.

netstat -n

Netstat tries to find out the name of every machine on your network through its IP address with something called DNS resolution.

When you already know the machine’s name, there’s no need to find out its name. So, you can stop Netstat from using additional resources with the “netstat -n” command.

Understanding Netstat By Practicing Netstat Commands

If you’re using a Windows machine, you can test these commands right now to get a better understanding. Press Windows+R to open the “Run” box. Then, type “cmd” and press Ctrl+Shift+Enter to access the Command Prompt in administrator mode.

With the Command Prompt opened, type “netstat -an” and press “Enter.”

Notice that by adding “n” to the command, Netstat won’t show the machine’s name based on its IP address. If you want to show the name, type “netstat -a.”

If you scroll further up, you should see the TCP and UDP sections.

You should also see port numbers are listening or using any connections right now. Possibly, you’ll see ports 135 and 445 open over TCP because Windows uses these ports to communicate.

Play With Netstat Commands For Education Purposes Only

Now, try to open any program or service and see what comes up. For example, open FileZilla and install an FTP server. Run the “netstat -a” command, and you should see that the FTP port has opened.

If you type “netstat -an,” you should see that port 21 is open over TCP. It’s listening or waiting for other users to connect to your FTP server. And if another computer on your network types a similar command, they should see your FTP server.

When they connect to your server, you should see their IP address, and you can determine if they’re someone from inside the network or some foreign attacker.

So, why is this important and not just amusing? Suppose you’re doing a security scan on your network. Netstat should show you what services are using what ports. When it’s not a program that you authorized, you can detect malicious attacks that way.

Furthermore, a Netstat security scan will show you what programs are using what ports. So, you can detect malicious programs and deal with them.

You should be able to tell what programs are running and how they behave inside the network. That way, you can terminate the executables and save the day.

On the other hand, you can tell whether it’s a legitimate activity and allow it.

Feel free to search for more Netstat commands and test them to see how they work.

It’ll provide you with tons of information that you can adapt to your security strategy.

What’s Nbtstat?

NetBIOS over TCP/IP status or Nbtstat is a Windows utility that shows current TCP/IP connections and statistics using NetBIOS over TCP/IP (NetBT). Nbtstat also reveals connections between Windows machines.

These Nbtstat commands allow you to communicate through NetBIOS parameters over TCP/IP. Commonly, NetBIOS is an unroutable protocol. However, the way Windows uses it over TCP/IP makes it possible to query other devices on your network by name or IP address.

From a security standpoint, you can use Nbtstat to query other machines on the network by name or IP address and understand what these users are doing.

You can also query workgroup members and domain users using the network. Furthermore, it’s possible to query your local machine and get the same information.

Similarly, you can type the command “nbtstat -n” to show all the local names on your machine. It’ll also show you the IP address of any remote device connecting to your device.

Taking it a step further, the “nbtstat -A [IP address]” will show you the NetBIOS names registered on the remote device.

When you don’t have the IP address of the remote devices, you can use the “nbtstat -a [Name of device]” command to find out the IP addresses of these devices. It’s a command that will send a name request to the IP.

In short, you can use the IP address and name interchangeably. If you have one, you can know the other.

You can find more Nbtstat commands and test them to see for yourself.

The alternatives to Netstat on Linux machines are net-tools, iproute2, and ss. These tools have different command lines but can provide you with similar information.

There’s no alternative to Nbtstat for Linux because it’s a Windows-specific tool. But you can find other tools that bring you the same information.