X-NetStat FAQ (5.63)

Q: How do I use the Packet Sniffer? [Back to top]

A:   When the Sniffer is enabled, you can see the bytes in/out for each connection.

First, make sure you press down the Sniffer button on the toolbar.  Nothing can be sniffed without this button down!

If you still don’t see anything, try using the WinPcap packet sniffer, which supports more network adapters. Go to www.winpcap.org and download WinPcap 3.1 and run the auto-installer.  A restart of your computer may be required.   Then, go into X-NetStat > Options >Packet Sniffer  and check the box that says Use WinPcap Sniffer.  Restart X-NetStat.

If you still don’t see anything, make sure you have installed the latest drivers for your network adapter, and then try either the X-NetStat sniffer or WinPcap again.

If you still don’t see anything, please report the bug to Fresh Software.  Click on the Sniffer menu at the top and choose Show X-NetStat Sniffer or Show WinPcap Sniffer, which ever item is available.   Check the box that says “Display Data” and then do some network activity.  Did anything show up in the Sniffer window?  What if you do the same process with the other Sniffer enabled?  Please let us know, along with the name and model of your network adapter, whether it is wireless or wired, what version of Windows you are using, and what version of X-NetStat you are using.

A note on Sniffing with Wireless adapters (from http://www.winpcap.org/misc/faq.htm#Q-16 )

Wireless adapters: these adapters may present problems, because they are not properly supported by the Windows Kernel. Some of them are not detected, other don’t support promiscuous mode. In the best case, WinPcap is able to see an Ethernet emulation and not the real transiting packets: this means that the 802.11 frames are transformed into fake Ethernet frames before being captured, and that control frames are not received. Again, refer to the http://www.micro-logix.com/WinPcap/Supported.aspto discover if your adapter works. If it doesn’t, you can use the trick explained in this video to capture its traffic.

Was this answer helpful? Let us know.

Q: How do I get X-NetStat to work with Ethereal? [Back to top]

A: First, you must download and install Ethereal from www.ethereal.com.  Then you must specify a default adapter to capture packets.  Open Ethereal, and click

    Edit Menu  > Preferences > Capture

Click the down arrow next to “default interface” and choose the same adapter/interface that X-NetStat is monitoring.

Click SAVE, and then OK.

Q: How do I know what application opened a port? [Back to top] A: If you use Windows XP, both editions of X-NetStat will display the application EXE (“process”) behind each connection. X-NetStat Professional will display more detailed information through the Process Information window (Full path to EXE, Product Name, Company Name, Version Info, etc) If you do not run XP, you can use the Port Database feature to make an educated guess. For example, the port databases would tell you that connections with port 80 are usually web-browser connections, port 1214 is used for KaZaA, etc.

Q: Are there any types of blocking mechanisms (once a connection is attempted) in X-NetStat? [Back to top] A: Both editions of X-NetStat can forcibly disconnect (“kill”) undesired connections manually, but X-NetStat Professional provides a more automatic way to continually block certain connections.  Just right-click on the connection in question and choose “Extended Kill” to create a rule that automatically kills a certain address. Additionally, X-NetStat Professional also has a Block Hostname tool to block contact with a hostname at the system-wide level.

Q: I have just installed your X-NetStat software, and what I found really surprised me. I found over hundred of remote addresses on my ports (mostly on port 1214), and I don’t know what to think about it. [Back to top] A: Port 1214 is used by the KaZaA media sharing program, and all these connections you see are media-sharing connections from that program.

Q: Does X-NetStat show UDP connections?  [Back to top] A: X-NetStat Standard currently does NOT show UDP connections.  X-NetStat Professional does.  

Q: Does X-NetStat do snmp to get info from routers? [Back to top] A: No.  X-NetStat 3.0 and 4.0 used SNMP to get its information, but this is no longer the case.  

Q: Can I automatically have X-NetStat send the results of tests to another machine via SNMP or email? [Back to top] A: In X-NetStat Professional, yes.  Set up a Rule, click the Actions tab and check “Send Email Notification”.  See the User’s Manual for more information on setting up a rule.

Q: What does a SYN_SENT connection mean? [Back to top] A: It isn’t technically a connection, but one waiting to be born. SYN_SENT means that a program on your PC has made a request for TCP communication to another computer, but has not yet received an acknowledgment (SYN_ACK).   It can be indicative (but not always) of a network problem somewhere between you and the remote computer.

Q: I use X-NetStat to block several IP addresses, but doing it through the Rules dialog is time consuming. Is there a better way? [Back to top]

A: Yes!  Right-click the connection and choose Extended Kill > Kill and Add Rule to AutoKill

Q: Is it possible to see with  X-NetStat, which machine on my network is heavily sending ICMP requests to another pc on the internet?  [Back to top]

A: Yes, in fact with X-NetStat Professional it shows you the number of ICMP going in/out right on the status bar!
Just double-click the status bar and check ICMP stats.