Digital Forensic Certification Practice Exam

Which netstat parameter is used to display active TCP connections and retrieve the process ID for each connection?

1. netstat -o

2. netstat -a

3. netstat -r

4. netstat -n

The correct answer is: netstat -o

The parameter utilized with the netstat command to display active TCP connections along with the process ID (PID) for each connection is indeed the one that includes the "-o" option. This option provides a comprehensive view of the active TCP connections on a system while linking each connection to the corresponding process ID, which is vital for identifying which application or service is using a specific connection. Using this parameter is particularly important in digital forensics and network analysis, as it allows investigators to correlate network activity with processes running on the machine. This can aid in identifying malicious activities or understanding the behavior of applications on the network. The other options serve different purposes. The "-a" option will show all connections and listening ports, but without the associated PIDs. The "-r" option displays the routing table, which is not related to TCP connections. Finally, the "-n" option presents the numerical form of addresses and ports, bypassing any DNS resolution, but it also does not include process identification. Therefore, the "-o" parameter is specifically designed for obtaining both active TCP connections and the process IDs, making it the appropriate choice.