Strange entries in Netstat output

Out of curiosity, I ran Netstat on my Windows PC, and I found some strange entries like:

xx-fbcdn-shv-01-amt2:https
edge-star-mini-shv-01-frt3:https
mil04s03-in-f10:https
xx-fbcdn-shv-01-amt2:https
fra16s25-in-f14:https
lu7:http
40:https
mil04s04-in-f12:https
wb-in-f188:https
ec2-52-86-85-106:https
db5sch101101419:https
bam-6:https

What are these/how can I tell what these are?

2 Answers

You can get more useful information from the Netstat command by adding the -f and -b parameters, like this:

netstat -f -b

According to the help (netstat -?) the -f switch:

Displays Fully Qualified Domain Names (FQDN) for foreign addresses.

And the -b switch:

Displays the executable involved in creating each connection or listening port. In some cases well-known executables host multiple independent components, and in these cases the sequence of components involved in creating the connection or listening port is displayed. In this case the executable name is in [] at the bottom, on top is the component it called, and so forth until TCP/IP was reached. Note that this option can be time-consuming and will fail unless you have sufficient permissions.

Put the two together and you'll see what processes are creating each connection and the full remote host name.

To aid in investigating the executables (and the connection's they're making) use Microsoft's Process Explorer. When you run the program you'll be presented with a list of everything running on your system, like this:

Then, to see the connections made by an executable, double-click it and have a look at the TCP/IP tab:

You noted that "ec2-52-86-85-106 turned out to be 52.86.85.106 which is Amazon, even though I wasn't connected to it." A reverse DNS lookup on the IP address returns ec2-52-86-85-106.compute-1.amazonaws.com, i.e., that is the fully qualified domain name (FQDN) that will be returned, because there is a PTR DNS record that associates that FQDN with that IP address. But you could have accessed in your web browser and the example.com domain name could have an A DNS resource record that associates that FQDN with the IP address 52.86.85.106. The 52.84.0.0 to 52.95.255.255 address block is assigned to Amazon by the American Registry for Internet Numbers. Amazon uses it for its Amazon Web Services (AWS).

Let's say I purchase the domain name example.com from a domain name registrar. I now want to host my website at and decide to use AWS to host my site. I configure DNS servers for my domain name to point to the IP address AWS has provided to me for the server hosting my site. Let's say that address is 52.86.85.106. So if you put in your web browser, your system connects to 52.86.85.106. But now you issue a netstat command on your system. You see a connection to 52.86.85.106, if you use netstat -an or you see ec2-52-86-85-106 if you omit the n argument to the command. So it may not be obvious to you, unless you issue an nslookup command on that your browser connection to my website is why you see ec2-52-86-85-106 in the results from the netstat command you issued.

In regards to the 1e100.net domain name you mentioned in another comment, as you discovered, the 1e100.net domain belongs to Google. 1e100 is scientific notation for 1 googol, i.e., 1 raised to the power of 100, which is 1 followed by one hundred zeros. Google uses the domain name for its servers. If you had recently accessed a Gmail account or or performed a search using google.com with a browser on your system, you might see that domain name returned in your results.

Another netstat command option is -o which will show you the process ID (PID) of the process that established the connection. You can then use the Windows Task Manager to link the PID to an application that you are running, e.g., Chrome, Firefox, Microsoft Edge, etc., by clicking on the details tab in the Task Manager to see the PID.