220-1102 Question 106
Single answernetstatA technician is troubleshooting a Windows 10 workstation that is connecting to an unfamiliar external IP address even when the user is not actively browsing. The technician wants to identify which local application or process is responsible for the connection by using netstat from Command Prompt. Which command should the technician run first?
- A
netstat -a
- B
netstat -n
- C
netstat -o
- D
netstat -r
Show answer and explanation
Correct answer: C
Explanation
For this troubleshooting scenario, the key requirement is to identify the local process responsible for an active network connection. On Windows, netstat -o adds the PID to the output, making it the most appropriate first step. A technician can then use Task Manager's Details tab or the tasklist command to match the PID to an executable or service. While netstat -a is useful for listing active and listening connections, and netstat -n is useful for numeric display of addresses and ports, neither alone identifies the owning process. netstat -r is related to routing information, not process attribution. Microsoft command-line documentation for netstat confirms that -o displays the owning process ID associated with each connection, which aligns with standard troubleshooting practice for suspicious network activity.
- A. Incorrect.
Incorrect. The -a switch displays all active connections and listening ports, which is useful for seeing what is open, but it does not identify the process ID associated with each connection. A technician using only this output would still need another step to determine which application is responsible.
- B. Incorrect.
Incorrect. The -n switch shows addresses and port numbers in numerical form instead of resolving names. This can make output faster and easier to read during troubleshooting, but it still does not show the owning process. It helps identify remote IP addresses more clearly, but not the local application behind them.
- C. Correct.
Correct. The -o switch displays the owning process ID (PID) for each connection. In this scenario, the technician needs to determine which local process is creating the suspicious outbound connection. After identifying the PID with netstat -o, the technician can correlate it in Task Manager or with tasklist to find the application or service involved.
- D. Incorrect.
Incorrect. The -r switch displays the routing table. That can help troubleshoot path and gateway issues, but it does not show which process opened a specific network connection. Someone might choose this if they confuse unexpected traffic with a routing problem rather than a process-level issue.