Controlling what enters and leaves our computer over the network has become as important as having a good antivirus . Simply connecting and crossing your fingers isn't enough: nowadays, bots, port scanners, and automated attacks try their luck on any IP address they find. Knowing how to use the command prompt (CMD), the firewall, and other network tools allows you to block suspicious connections before they become a problem.
In the following lines, you'll see how to use commands like netstat, netsh, the Windows Firewall, and other filtering systems to identify suspicious connections, block malicious IPs, protect your ports, and generally strengthen your network security on both Windows and Linux, and even on network devices like a FortiGate firewall. I'll tell you right now, it's not a matter of "black magic": with a couple of well-understood commands, you can have a level of control that many users can't even imagine.
Netstat and company: a quick overview of your connections
The starting point for blocking suspicious connections is knowing who is connected to what on your computer . That's where netstat comes in, a veteran utility that has existed since the 90s on Unix, Windows, Linux, macOS and even less common systems, and which remains one of the most useful commands for auditing the network.
The tool's name says it all: Network + Statistics . Netstat displays TCP and UDP connection tables, listening ports, traffic statistics, errors, and even a basic routing table . This allows you to see if there are unexpected open ports or active sessions with remote IPs that don't seem right.
Before using it seriously, it's a good idea to close all possible applications , even restarting your computer and opening only the essentials, and check how many devices are on your network . This way, the data netstat shows you will be cleaner, without the noise of background programs you're not interested in at that moment, and it will be easier to spot suspicious connections.
Although netstat doesn't have a graphical interface, on Windows you can use utilities like TCPView or GlassWire , which essentially display the same information with a more user-friendly interface. On Linux, tools like iftop, iptraf, or ss also provide a very clear view of real-time traffic and, in many cases, are more convenient for beginners.
Keep in mind that if you overuse netstat with a lot of parameters and run it constantly, it can consume resources and put a strain on the machine , especially if there are thousands of connections. It's not exactly "dangerous," but there's no point in running it every two seconds on a production server if you don't need to.
Advantages and limitations of netstat for detecting suspicious connections
Used wisely, netstat provides powerful visibility into what's happening on your network . You can list all active connections, see which ports are open, and what processes are running in the background. This helps you:
- Locate unauthorized connections or processes that connect to unusual IP addresses.
- Detecting bottlenecks or congestion by observing session volume and error statistics.
- Trace persistent sessions that remain open and can cause performance problems.
- Analyze your server's behavior and decide which ports you really need to have exposed.
The command provides very detailed output, including counters for sent and received packets, errors by protocol (TCP, UDP, ICMP, IPv4, IPv6, etc.), and even routing table paths with `netstat -r` . All of this is invaluable when diagnosing connectivity issues or verifying that a configuration is correctly applied.
The downside is that netstat has several significant drawbacks in modern environments . For starters, the output can be quite cryptic for anyone unfamiliar with networking concepts: ports, TCP states, protocols, and so on. Furthermore, newer Windows systems are pushing administrators toward PowerShell and other more advanced tools , so learning netstat by heart might not be the best long-term investment.
It should also be mentioned that it doesn't encrypt anything or offer in-depth analysis : it shows you data, but if you want to correlate it with attack patterns, intrusion detection, or serious forensic analysis, you'll have to rely on other solutions like IDS/IPS, SIEM, or packet sniffers like Wireshark.
In large networks with thousands of distributed devices and services, netstat becomes unwieldy. It's not scalable and isn't designed to monitor an entire corporate environment; that's where SNMP solutions, observability tools, centralized monitoring, or products like Microsoft Defender for Endpoint come in.
Practical netstat commands for hunting for unusual traffic
In Windows, to begin, simply open a CMD or Terminal window as administrator and type:
- netstat: shows the basic active connections.
- netstat -n: displays IPs and ports in numeric format, without resolving DNS names.
- netstat -sStatistics by protocol (TCP, UDP, IPv4, IPv6…).
- netstat -e: general interface statistics (bytes sent/received, errors…).
- netstat -a: includes listening ports and established connections.
- netstat -o: adds the Process ID (PID) associated with each connection.
- netstat -p TCP: filters by protocol (TCP, UDP, TCPv6, UDPv6...).
If you want the information to update automatically at regular intervals, you can combine parameters with an interval: for example, netstat -n 7 refreshes every 7 seconds, which is useful for seeing connections that appear and disappear very quickly when a suspicious session is established.
To locate only established connections, you can use the classic combo box with findstr:
- netstat | findstr ESTABLISHED
By changing ESTABLISHED to LISTENING, CLOSE_WAIT, or TIME_WAIT, you can focus on the TCP state that interests you depending on the problem you're analyzing. This, combined with the PID and fully qualified domain name using netstat -f , gives you a very clear idea of which process is connecting to which remote server.
A typical example for security is to run netstat -ano and check:
- remote IPs that you don't recognize.
- Local high ports are listening for no apparent reason.
- Processes with many failed connection attempts.
If you see a suspicious IP address, you can go to Task Manager , search for the PID, and see which application it is. From there, you can decide whether to uninstall it, run an antivirus scan, or block the connection with your firewall.
Network monitoring and analysis alternatives
While netstat is a good starting point for viewing connections, when you want to delve deeper into network security , specialized tools come into play . Some common ones are:
- Wireshark: captures and analyzes packets at a low level, ideal for see exactly what data is being sent, detecting attempts at exploitation or unencrypted traffic where it shouldn't be.
- GlasswireIt combines traffic monitoring with a Visual firewall and alerts, very useful at the advanced user level or small office.
- Cloudshark: web solution for uploading packet captures, analyzing them, and sharing them as a team.
- ss, iptraf, iftop On Linux: they show sockets, traffic flow, and connections in real time in a more modern and clear way than netstat.
- ipRoute2: a set of utilities for handling routes, tunnels, and advanced network policies in Linux (largely replaces older tools).
In professional environments, platforms such as Uptrends, Germain UX, Atera and similar ones are also common, designed to monitor availability, performance and user experience on websites and services, with alerts when something goes down or starts to degrade.
Microsoft Defender, network protection, and C2 blocking
On Windows 10, Windows 11, macOS, and Linux, a key component for blocking suspicious network connections is Microsoft Defender Network Protection . This feature extends what SmartScreen in Microsoft Edge does to the rest of the system: it monitors not only the browser but also other browsers and processes like PowerShell or desktop applications.
The idea is simple: when a program tries to connect to a URL or IP address with a bad reputation (phishing, malware, command and control, etc.), Defender compares the request against its lists (and your custom flags ) and decides whether to allow it, audit it, or block it outright. This screening works for both HTTP and HTTPS traffic and isn't limited to ports 80 or 443: it inspects all outgoing connections to any port.
In a security context, one of its most important functions is its ability to detect and disrupt communications with command and control (C2) servers , which are used by many malware and ransomware families to receive commands and exfiltrate data. Breaking this communication channel often halts the attack's progression.
In practice, network protection relies on several sources: SmartScreen reputation, internal Microsoft IoCs, your own custom blocklists , and web filtering categories (adult content, gambling, etc.). Based on what it detects, it categorizes events such as phishing, malicious, C2, custom policies, etc., which you can then view in reports, advanced search, or within Microsoft Defender for Endpoint.
Operating modes: audit or block
Defender allows you to activate network protection in two modes: audit mode and block mode . This is very useful for avoiding problems in a production environment.
- En audit modeThe system records all the accesses it would have blocked, but It doesn't cut the connectionYou can review these logs in the console (by querying DeviceEvents with ActionType as ExploitGuardNetworkProtectionAudited) and see the potential impact.
- En lock modeDefender takes action: blocks traffic to marked domains and IPs by SmartScreen, by your custom indicators, or by content filtering policies.
From the user's point of view, when they come across a "dubious" site, three things can happen:
- If the reputation is good, he doesn't see anything strangeNavigation continues normally.
- If reputation is uncertain, a warning screen with the possibility of skipping it (unblocking it) for a few hours.
- If the reputation is clearly malicious or you have explicitly blocked it, a block with no option to circumvent (unless the administrator changes the policy).
All of this behavior can be fine-tuned with policies: for example, there's an option to convert all warnings into hard blocks , so the user can't bypass them. This can be configured via CSP, GPO, or MDM tools, depending on how you manage your device fleet.
To complete the process, administrators can create allow flags when they detect false positives or need to enable a specific service. These allow flags take precedence over most blocks, giving you room to adjust settings without having to disable all network protection.
Blocking connections via firewall and rules in Windows
Beyond Defender, another way to block suspicious network connections is through the Windows Firewall itself . This firewall is integrated, updates automatically with the system, and allows you to control both which programs can access the internet and which ports are accepted from outside.
From the graphical interface you can create inbound and outbound rules, but if you want to fine-tune or automate, it's also helpful to know the netsh advfirewall commands . For example:
- netsh advfirewall set currentprofile state on: activates the firewall in the current profile.
- netsh advfirewall firewall add rule name="Block IP X" dir=in action=block remoteip=xxxx: blocks incoming traffic from a specific IP.
- netsh advfirewall firewall add rule name="Open Port 80" dir=in action=allow protocol=TCP localport=80: Opens port 80 for incoming connections.
- netsh advfirewall firewall delete rule name="Open Port 80": removes the previous rule.
- netsh advfirewall reset: restores the firewall's default settings.
If you want to block an IP address because it's overwhelming you with access attempts (for example, a brute-force attack or a heavy scanner), you can create a custom inbound rule from the Windows Firewall with Advanced Security graphical console that:
- It applies to “All programs”.
- Use the "Anyone" protocol.
- In “Remote addresses” specify the IP or range to block.
- Select the “Block connection” option.
- It applies to domains, private and public networks.
This will prevent that IP address from interfering with your system. However, be careful not to enter too large a range , as this could block IP addresses from search engines or legitimate users.
To find out which ports your firewall is actually blocking, you can enable packet logging in the profile properties and then check the pfirewall.log file located at %systemroot%\system32\LogFiles\Firewall. There you will see details of the ports and addresses being dropped.
Block IPs and ports from hosting, .htaccess and other layers
When the problem of suspicious connections is focused on your website (login attempts, spam, automated bots, minor DDoS attacks, etc.), simply taking action on the PC isn't always enough. Often, it's best to block IPs directly on the hosting server or using the web server itself.
In control panels like Plesk, you can add IPs to block lists to prevent them from even loading your site . Another classic option is to edit the .htaccess file if you're using Apache, adding rules like:
Order Allow,Deny Deny from 192.168.xx.x Allow from all
Or, use multiple Deny lines for different IP addresses. From then on, any request from those IPs will encounter an error, preventing your content from loading or consuming application resources. It's a simple yet effective solution for stopping bots that repeatedly attack your CMS or scripts that spam forms.
If you're experiencing attacks originating from specific countries and your server allows it, you can even implement geoblocking using rules that analyze country codes (for example, CN for China) and redirect to an error page. However, be aware that this will also block access for legitimate users and sometimes even search engine bots if not properly managed.
Another less aggressive alternative to hard IP blocking is to combine rate limiting , CAPTCHAs, and the use of CDNs with DDoS mitigation. This way, instead of manually blocking IPs, you reduce the impact of abuse without disrupting as much legitimate traffic.
Port forwarding, risks and how to control it
Many applications (online games, home servers, P2P programs, NAS devices, etc.) require you to open or forward ports to function properly. The problem is that each open port is a potential entry point if the underlying service has security vulnerabilities or is not correctly configured.
Port forwarding involves telling your router to redirect any incoming connection from the internet to your public IP address on a specific port to a specific internal machine and port within your local network. For this to work, you typically need to have NAT enabled and a clear understanding of which services you will be exposing.
There are several basic types of forwarding:
- Local News: It is used to access internal services from your computer but through a tunnel (for example, SSH).
- Remote: allows a service on your machine to be accessible from another remote location.
- Dynamic: turns your client into a kind of SOCKS proxy, allowing other applications to use the tunnel to reach different destinations.
Before opening anything outwards, it is advisable to:
- Check that the The service is up-to-date and properly configured..
- Limit access by IP, VPN or strong authentication whenever possible.
- Avoid opening typical ports unnecessarily (RDP, SMB, etc.).
Remember that many modern threats (DNS modification, Man-in-the-Middle attacks, DoS botnets, creation of fake Wi-Fi networks ) exploit uncontrolled exposed ports on home or business routers. Therefore, it's best to expose only the bare minimum and monitor it closely.
Logs, auditing, and detection of suspicious activity
Blocking connections blindly can be dangerous; you need a basis for making decisions. That's where system, firewall, and application logs come in . In Linux, for example, most of these logs reside in /var/log , and their management is defined by rsyslog and the corresponding configuration files.
In Windows, in addition to the firewall log, you can review the Event Viewer , filtering for events related to network and firewall protection (IDs such as 5007, 1125, 1126, etc.). You also have the Microsoft Defender Advanced Search , where you can query tables like DeviceEvents and DeviceNetworkEvents to see what has been audited or blocked by network protection.
For example, to list events where network protection has audited or blocked something in browsers other than Edge, you could run queries like:
DeviceEvents | where ActionType in ("ExploitGuardNetworkProtectionAudited","ExploitGuardNetworkProtectionBlocked")
Or filter specifically by SmartScreenUrlWarning if you want to focus on SmartScreen warnings in Edge. This information helps you identify patterns : domains that many users visit and get blocked, IPs that should be added to a global blocklist, etc.
In larger environments, it is common to centralize these logs in a SIEM or in tools like Power BI to generate custom reports, security dashboards, and automatic alerts when a certain response category appears (Malicious, Phishing, CustomBlockList, etc.).
Mastering commands like netstat, netsh, UFW, and firewall-cmd, leveraging Microsoft Defender's network protection, knowing how to block IPs in the Windows Firewall, your hosting provider, or a FortiGate, and regularly reviewing network logs gives you a powerful toolbox for stopping suspicious network connections before they cause serious problems. You don't need to be a telecommunications engineer to get started: with a few well-learned commands and a bit of common sense, you can keep your computers, servers, and websites significantly better protected than average.
