Which command should a technician use to investigate bandwidth overuse on a single workstation?
A user reports that the internet seems slow on a workstation, but no other users have reported any issues. The server team confirms the servers are functioning normally. A technician suspects something specific to the user's computer is overutilizing bandwidth. Which of the following commands should the technician use to further investigate the issue?
Community Votes
73% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests your knowledge of command-line network utilities and when to use them; the common trap is choosing tcpdump because bandwidth sounds like packet capture, but netstat is the quicker first step for checking active connections and the process behind them.
For CompTIA Network+ N10-008, netstat is the correct command to identify which application or connection on a workstation is consuming bandwidth because it displays active connections and associated process IDs. Community discussion favors netstat over packet-capture tools like tcpdump for this single-workstation scenario.
B. tcpdump is the most common wrong choice. Test takers think capturing packets will directly reveal bandwidth usage, but netstat is better because it lists established connections and, with -o or -b, identifies the PID or executable responsible.
Community Discussion (6 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Netstat displays active network connections, listening ports, and, depending on the operating system flags, can show the process ID associated with each connection. On Windows, netstat -b shows the executable name, and netstat -o shows the PID, which lets the technician link a specific application to network activity. It also shows current TCP/UDP endpoints, helping determine whether an app, service, or potentially malicious program is saturating the workstation's bandwidth. Community commenters noted that netstat "can show the amount of data being sent and received" and "provides a detailed list of active network connections and their associated ports." This makes netstat the correct first investigation command when the issue is isolated to one user's computer.
Why the Other Options Are Wrong
A. nmap is a network scanning tool used to discover open ports and services on networked devices; it does not measure a local workstation's bandwidth consumption. D. nslookup is used to query DNS records and has no role in diagnosing local bandwidth usage. B. tcpdump is a packet capture and analysis tool that can examine network traffic in real time, but it is not a built-in Windows command and does not directly tie captured traffic to a local application as cleanly as netstat with process flags. Comments favoring tcpdump argue that it can "capture and analyze packets in real time," but netstat is more targeted for identifying which process on a workstation is using bandwidth.
Community Comment Notes
The highest-rated comments selected C and explained that netstat is useful for listing active connections and ports, which can identify applications or services using network resources. One comment emphasized that netstat helps diagnose "bandwidth utilization issues" by showing connection states and transmitted data information. A smaller subset of users selected B, tcpdump, because of its real-time packet inspection capability, but they were in the minority. Overall, the community supports netstat as the expected answer for a workstation-specific bandwidth problem in this exam context.
Official Reference
Exam Strategy
Remember the value of netstat flags: on Windows, netstat -b identifies the executable and netstat -o shows the PID for each connection. When an exam question asks which command to use to see what is using the network on a single workstation, choose netstat over packet capture tools like tcpdump or nmap.