Which of the following commands would be the BEST to run to view only active Internet connections?

A security analyst is reviewing network connectivity on a Linux workstation and examining the active TCP connections using the command line.

Which of the following commands would be the BEST to run to view only active Internet connections?
A . sudo netstat -antu | grep “LISTEN” | awk ‘{print$5}’
B . sudo netstat -nlt -p | grep “ESTABLISHED”
C . sudo netstat -plntu | grep -v “Foreign Address”
D . sudo netstat -pnut -w | column -t -s $’w’
E . sudo netstat -pnut | grep -P ^tcp

View Answer

Answer: E

Explanation:

Reference: https://www.codegrepper.com/code-examples/shell/netstat+find+port

The netstat command is a tool that displays network connections, routing tables, interface statistics, masquerade connections, and multicast memberships. The command has various options that can modify its output.

The options used in the correct answer are:

p: Show the PID and name of the program to which each socket belongs.

n: Show numerical addresses instead of trying to determine symbolic host, port or user names.

u: Show only UDP connections.

t: Show only TCP connections.

The grep command is a tool that searches for a pattern in a file or input.

The option used in the correct answer is:

P: Interpret the pattern as a Perl-compatible regular expression (PCRE).

The pattern used in the correct answer is ^tcp, which means any line that starts with tcp. This will filter out any UDP connections from the output.

The sudo command is a tool that allows a user to run programs with the security privileges of another user (usually the superuser or root). This is necessary to run the netstat command with the – p option, which requires root privileges.

The correct answer will show only active TCP connections with numerical addresses and program names, which can be considered as active Internet connections. The other answers will either show different types of connections (such as listening or local), use different options that are not relevant (such as -a, -l, -w, or -s), or use different commands that are not useful (such as awk or column).

Reference:

https://man7.org/linux/man-pages/man8/netstat.8.html

https://man7.org/linux/man-pages/man1/grep.1.html https://man7.org/linux/man-pages/man8/sudo.8.html