Windows – What does “msnbot” mean in netstat listings

There is nothing wrong with reading things from /proc. In fact, that is where those tools get that information from. There are actually three files with the command name.

/proc/PID/cmdline
/proc/PID/stat
/proc/PID/status

I believe it is usually obtained from stat.

Use the -b option on Windows' netstat command to show what program is listening

  -a            Displays all connections and listening ports.
  -b            Displays the executable involved in creating each connection or
                listening port. In some cases well-known executables host
                multiple independent components, and in these cases the
                sequence of components involved in creating the connection
                or listening port is displayed. In this case the executable
                name is in [] at the bottom, on top is the component it called,
                and so forth until TCP/IP was reached. Note that this option
                can be time-consuming and will fail unless you have sufficient
                permissions.

Generally, it is only server type applications that listen for incoming connections. Windows however also has services that listen for NETBIOS broadcasts and other types of MS network chatter.

C:\> netstat -ab

Active Connections

  Proto  Local Address          Foreign Address        State           PID
  TCP    Boxname:http           Boxname:0              LISTENING       1708
  [Apache]

  TCP    Boxname:netbios-ssn    Boxname:0              LISTENING       4
  [System]

  …