3.2Endpoint security assessment tools

When you sense that "this PC is acting strange," the basic move is not to judge by intuition but to first confirm the endpoint's own state with numbers and records. Three staple tools serve this: netstat to see what it is currently connected to and which ports it is listening on, nslookup to check which IP a name (domain) resolves to, and tcpdump to capture the actual packets flowing and inspect their contents. This section distinguishes what question each of the three answers and aims to let you judge "which tool is appropriate to confirm this suspicious symptom." You need not go into deep packet analysis; being able to identify the difference in roles is enough to start.

3.2.1netstat: connections and listening ports

• netstat lists an endpoint's current connections and the ports it is listening on. It reveals "which process is connected to which external address on which port." A suspicious outbound connection or an unexpected listening port can be a clue to malware or a backdoor.
• For example, netstat -ano (Windows) may show an unfamiliar port like 0.0.0.0:4444 in the LISTENING state; you then investigate using the process ID that opened it. It is the first tool when you want to confirm "what it is communicating with" and "which entry points it has opened."

3.2.2nslookup: checking name resolution

• nslookup queries DNS to check which IP address a domain name resolves to (or the reverse). It confirms "is the name resolving to the correct IP?" and "has it been tampered with by an attacker?"
• For example, if a legitimate site's name resolves to an unfamiliar IP, suspect DNS poisoning or a tampered hosts file. nslookup example.com returning an unexpected IP is a typical way to isolate a name-resolution anomaly. It is the tool when you suspect "the mapping between name and IP," not ports or packets.

3.2.3tcpdump: packet capture

• tcpdump captures and displays the actual packets flowing through a network interface (standard on Linux/macOS; Wireshark and the like are equivalents on Windows). It lets you observe the raw state of communication—source/destination, protocol, and part of the payload.
• Use it when you want to confirm "what is actually flowing," which a connection list (netstat) or name resolution (nslookup) alone cannot show. At the CCST (introductory) level, deep packet analysis is not required; identifying its role as "the tool that captures packets and observes their contents" is enough. In practice, filter expressions to narrow down from heavy traffic to just the relevant packets matter.

Suppose a user reports, "my PC is oddly sluggish, and the network light keeps blinking at night when no one is using it." The first suspicion is "something may be communicating externally on its own," so the first move is netstat. Run netstat -ano to see the connection list and listening ports, and check for an ESTABLISHED connection to an unfamiliar external address or a suspicious listening port like 0.0.0.0:4444. If a connection to a suspicious external domain turns up, next use nslookup to verify whether that domain is genuine—whether it resolves to a legitimate IP or points to what looks like an attacker's server. If the "name-to-IP mapping" itself is off, a different angle—DNS poisoning or a tampered hosts file—comes into view. When you reach the stage of confirming "what is actually being sent," finally use tcpdump to capture that traffic's packets and observe the raw state. The key idea: use the three tools according to the symptom (what it connects to / whether name resolution is correct / what the actual packets are). Rather than running everything at once indiscriminately, first get a bearing with netstat, then drill down to nslookup or tcpdump as needed—this sequencing is the trick to closing in on the cause in limited time. At the introductory level, prioritize choosing the right tool for the symptom over memorizing each tool's deep options.

3.2.4Section summary

• netstat lists current connections and listening ports, surfacing suspicious peers and open entry points
• nslookup queries DNS to check the name-to-IP mapping and isolate name-resolution anomalies (tampering)
• tcpdump captures actual packets to observe their contents; using the three tools according to the symptom is the basic skill