Examkin

Question

Difficulty: MediumUtilizing Command-Line Network Troubleshooting Utilities

A system administrator suspects a Windows workstation has been compromised and is sending outbound traffic to an unknown command-and-control server. The administrator opens Command Prompt to determine which local Process ID (PID) is responsible for establishing active outbound socket connections. Which command-line utility switch combination should the administrator execute to view numerical IP addresses, active connection states, and their corresponding process IDs?

  1. netstat -anoAnswer
  2. B
    arp -a
  3. C
    ipconfig /displaydns
  4. D
    nslookup -type=any

Answer

The command 'netstat -ano' accurately lists active network connections along with numerical IP addresses, port numbers, and owning Process IDs.
Executing 'netstat -ano' combines three flags: '-a' displays all active connections and listening ports, '-n' displays IP addresses and port numbers in numerical format (avoiding slow reverse-DNS lookups), and '-o' appends the owning Process ID (PID) column to the output. This gives security analysts and system administrators the exact data required to map suspicious network connections to running system processes.

Step-by-Step Solution

1
Identify the diagnostic goal
The goal is to inspect active TCP/UDP connections and map them to local process identifiers (PIDs).
Correlating socket connections to PIDs allows the administrator to terminate or analyze suspicious software processes.
2
Evaluate command-line options for process and socket inspection
The 'netstat' command is designed to query network statistics and protocol connections on host OS platforms.
Other utilities like 'arp' or 'nslookup' operate on different OSI layers or perform external DNS lookup functions.
3
Select the correct combination of switches
The '-a' switch displays all connections and listening ports, '-n' prevents DNS name resolution for faster numerical viewing, and '-o' appends the Process ID (PID). Combining them yields 'netstat -ano'.
This output provides the exact PID needed to correlate network connections with active running processes in Task Manager or CLI toolsets.

Key Concept

Utilizing command-line network utilities (netstat) to inspect active connections and process identifiers.
Rate this question

Topics

Utilizing Command-Line Network Troubleshooting Utilities

More questions from this topic