INITIATING NETWORK ACTIVITY IN WINDOWS USING NETSTAT

Abstract

The purpose of the article. The aim of the article is to create a complex approach to the initiation and analysis of network activity in the windows operating system with the help of the netstat utility with references to the current demands related to tracking of the system and guaranteeing the opportunity to interpret the findings of diagnostic activities in the most effective way. The work will also try to standardize the use of Netstat, complement it with other tools to automate the analysis of the data and translate its proposals into concrete recommendations for the system administrators and the cybersecurity experts. Specific applications for identifying network connections, anomaly detection and load analysis also play a crucial role in the stability and security of information systems in a dynamic network environment.Scientific novelty. The scientific novelty of the research is the creation of a classification of TCP connection states on the basis of data obtained using netstat that permits effective interpretation of the information about network activity in the context of system diagnostics. The architecture of the monitoring system proposed in this work, which features four major components: primary data collection, processing, analysis, and notification about anomalies, extends classical approaches to the usage of Windows utilities. The combination of netstat together with modern automation and data analysis techniques, especially with time series and logging, provides new possibilities for trend and anomaly detection.Results. As part of the study, the functionality of netstat was explored in detail, particularly the -a, -n, -o, -s and -r options, which give a complete listing of active connections, IP address, process ID, statistics for network protocols and routing tables. The classification table of TCP connection states (LISTENING, ESTABLISHED, TIMEWAIT, CLOSEWAIT) with description of diagnostic values and recommendations was created, according to which problematic states can be identified, for example, long CLOSE_WAIT. The results obtained from the network sessions with IP addresses 127.0.0.1 and 192.168.0.161 and ports 161:4147-4149, shown in Figure 2, provide information related to the intensity of the activity of the web applications, system processes and also the existence of potential anomalies. Ways for scripting to automate the data collection and connection with logging systems for building time series are suggested.Conclusions. The study has proven that netstat is efficient for starting and monitoring the network activity in windows and is a useful tool with its advanced command-line parameters and organized method to capture the data for diagnostics. The resulting monitoring architecture and connection state classification provides the foundations for integration of traditional utilities with modern technologies such as machine learning. Future work opportunities: development of algorithms for automatic anomaly detection, integration with cloud systems, development of adaptive alerting systems, with practical consequences in the field of security and optimization of network resources (cybersecurity).