2. Run netstat an on your own computer. On a computer running Microsoft Windows, open a command prompt. Often this can be done by going to the Start menu, then choosing Programs > Accessories > Command Prompt. The netstat command will actually work on many other operating systems, including Linux and Mac. The output will be something like below:

Active Connections

Proto Local Address Foreign Address State

TCP 0.0.0.0:135 0.0.0.0:0 LISTENING

TCP 0.0.0.0:445 0.0.0.0:0 LISTENING

TCP 0.0.0.0:2869 0.0.0.0:0 LISTENING

TCP 0.0.0.0:38068 0.0.0.0:0 LISTENING

TCP 0.0.0.0:49664 0.0.0.0:0 LISTENING

TCP 0.0.0.0:49665 0.0.0.0:0 LISTENING

TCP 0.0.0.0:49666 0.0.0.0:0 LISTENING

TCP 0.0.0.0:49667 0.0.0.0:0 LISTENING

TCP 0.0.0.0:49669 0.0.0.0:0 LISTENING

TCP 0.0.0.0:49694 0.0.0.0:0 LISTENING

TCP 10.0.0.238:139 0.0.0.0:0 LISTENING

TCP 10.0.0.238:53031 131.253.34.232:443 ESTABLISHED

TCP 10.0.0.238:53179 216.58.194.130:443 TIME_WAIT

TCP 10.0.0.238:53180 151.101.49.121:443 ESTABLISHED

TCP 10.0.0.238:53181 151.101.49.121:443 ESTABLISHED

TCP 10.0.0.238:53182 151.101.49.121:443 ESTABLISHED

TCP 10.0.0.238:53187 151.101.49.121:443 ESTABLISHED

TCP 10.0.0.238:53188 151.101.49.121:443 ESTABLISHED

TCP 10.0.0.238:53189 151.101.49.121:443 ESTABLISHED

TCP 10.0.0.238:53192 207.126.123.113:443 ESTABLISHED

TCP 10.0.0.238:53196 184.31.241.232:443 ESTABLISHED

TCP 10.0.0.238:53198 23.207.18.195:443 ESTABLISHED

TCP 10.0.0.238:53199 72.21.211.11:443 ESTABLISHED

TCP 10.0.0.238:53200 72.21.211.11:443 ESTABLISHED

TCP 10.0.0.238:53212 8.43.72.52:443 ESTABLISHED

TCP 10.0.0.238:53213 216.58.194.130:443 TIME_WAIT

TCP 10.0.0.238:53214 8.43.72.52:443 ESTABLISHED

TCP 10.0.0.238:53215 8.43.72.52:443 ESTABLISHED

TCP 10.0.0.238:53218 176.32.96.208:443 ESTABLISHED

TCP 10.0.0.238:53240 23.36.68.241:443 ESTABLISHED

TCP 10.0.0.238:53248 216.58.194.102:443 ESTABLISHED

TCP 10.0.0.238:53250 23.36.68.241:443 ESTABLISHED

TCP 10.0.0.238:53256 8.43.72.98:443 ESTABLISHED

TCP 10.0.0.238:53258 23.43.160.49:443 ESTABLISHED

TCP 10.0.0.238:53261 23.43.160.96:443 ESTABLISHED

TCP 10.0.0.238:53264 107.178.254.65:443 ESTABLISHED

Notice that each line has the following columns: Proto, Local Address, Foreign Address and State. Lets examine each one.

The name of the first column, Proto, stands for protocol and is either TCP or UDP. TCP and UDP are two types of network protocols in the Internet. Notice that the TCP lines all end with either ESTABLISHED or LISTENING for a state. ESTABLISHED connections are those that are actively being used to transfer data. The LISTENING connections are not currently being used to transfer data but they represent server software that is ready to accept and respond to requests should they arrive.

The foreign and local address portions of each line are composed of two portions separated by a colon -- an IP address and a port number. The IP address indicates the numerical address of the computer on which the network software is running. The port number indicates the mailbox number on that particular computer for that particular service or network conversation.

You can investigate each type of server running on your machine. For example, consider the line:

TCP 0.0.0.0:135 0.0.0.0:0 LISTENING

It says that a service is listening on TCP port 135. If I want to know what port 135 is typically used for, I can do a Web search for TCP port 135.

Now do a netstat an command on your computer, copy and paste the output below. Then select three services currently running on your computer, identify their port number, and conduct a web search and find out what type of service typically runs on these ports? How some computer viruses could have exploited flaws in these services?

Your output and findings: