Hi I have an application server, Server1, running on Windows 2008 Server. I have clients from many subnets connecting to it, some are on the same LAN, some are connecting across the WAN. We often have connectivity issues so I was looking for a program/function that told me whether the server had actually recvd the connection from the client and what state it was in. I figured on Netstat but then came across TCPView. I had some questions I was hoping someone could assist me with: 1. If I had a connection from a client at 192.168.1.246, is there a way to actually filter for this, or do I need to sort by IP address (Remote Address). 2. If I had a suspect connection from 192.168.2.123 and wanted to close this, what's the best way to do this? 3. I see there are connection states of: Listening Established Close_Wait Last_ACK etc. Does anyone have a handy link to explain what these mean?

The output from TCPView is more detailed but similar to netstat. The following article outlines the connection and disconnection process, as well as explains the various states reported by netstat/TCPview. Perhaps it will be of some help. http://support.microsoft.com/kb/137984 Rob

Hi, Thanks for posting here. >1. If I had a connection from a client at 192.168.1.246, is there a way to actually filter for this, or do I need to sort by IP address (Remote Address). You may consider using Procmon which also a utility of windows sysinternal . You can achieve the goal by using build in filter feature: http://technet.microsoft.com/en-us/sysinternals/bb896645 >2. If I had a suspect connection from 192.168.2.123 and wanted to close this, what's the best way to do this? you may also consider using windows build in firewall to block remote addresses. Creating New Rules http://technet.microsoft.com/en-us/library/cc771477(WS.10).aspx Thanks. Tiger LiPlease remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.